Back to feed

The form in the dark: a lead-capture leak that cost me an unknown number of yeses

A waitlist form on my own site was silently routing to a third-party system with no active listener. Native form, Vercel handler, Supabase table, Resend email. The new rule.

The short answer A category of bug that costs nothing until it costs everything: a form that returns a success message and files the record where nobody reads it. Iframes and third-party embeds are silent-failure surfaces. Every form on every property is now native HTML, Vercel API handler, Supabase row, Resend confirmation, and an optional best-effort sync to whatever downstream automation exists.

The Counsel Room waitlist form on my own site was routing to nowhere.

Someone signed up. I never got an email. They never got a confirmation. The form returned a success message, the page said thanks, and the actual record went to a third-party system that had no active listener on the other end.

I found it because someone told me they had signed up and I had not replied. That's the worst way to find it.

I opened the page in an incognito window. Submitted a test entry. Got the same green success message. Nothing in my inbox. Nothing in the third-party dashboard alert queue. The form was a UI trick pretending to be a system.

What broke

An iframe pointing to a hosted form on a subdomain of a platform I use for other automations. The subdomain was correctly wired months ago. Then I moved automations off it and forgot the waitlist form was still pointed at it. The form kept accepting submissions. Nobody was listening.

There is a category of bug that costs you nothing until it costs you everything. This is that bug.

The fix

Ripped the iframe. Built a native form on the page, a Vercel API handler behind it, a Supabase table for the record, and Resend for the two emails that have to fire on every submission: one to me so I know a human is waiting, one to the human so they know they're on the list.

The pattern is now the rule for every form on every property I run. If the form is not native to my stack, I do not trust it to notify me. Iframes are a last resort. Third-party embeds are a last resort. My stack is native form, Vercel handler, Supabase row, Resend confirmation, optional best-effort sync to whatever automation platform is downstream.

What I learned

If a form on my own site can silently swallow a signup for weeks, my growth rate is not what the analytics say it is. My growth rate is what the plumbing lets through. Every silent-failure surface is a leak in the funnel that no dashboard will ever show me.

The Counsel Room is small right now. The leak was small. But the same architecture ran the last three lead-magnet forms on the last three property launches. I don't know how many yeses I never saw.

What's next

Auditing every form on every property this week. Same test: incognito submit, check inbox, check database, check downstream automation. If any leg is missing, rebuild the form native. No exceptions.

PS: The Counsel Room opens July 21. A private room for bar pros who want to charge for what they already know. Pricing playbook, proposal templates, live weekly office hours, and the systems I use to run my consultancy solo. Waitlist is open. jlittrell.com/counsel

PPS: KMS Ops is the operating system I built to run my own consultancy solo. Reviews, messaging, booking, follow-up, client dashboards. One place, one login. kmsops.com

Running businesses, building systems, Jason Littrell