Andrew here, week 7.
WingStop, yes the MASSIVE chicken franchise, brought us in to run a limited box drop a couple months back. Hyped, early-bird, the kind of thing their real fans set a 9am alarm for.
It sold out in 47 seconds.
Sounds like a win. It wasn't. Almost none of those 47 seconds were human.
The moment the drop opened, the bots hit it. Software built to buy up limited inventory in bulk, faster than any thumb can move. The superfan who set the alarm never stood a chance. She's still hunting for the "add to cart" button while a script three steps ahead of her clears the shelf.
And the bot doesn't even want the wings. It wants to flip the box, or it's just noise jamming the checkout. Either way, the person the drop was built for walks away with nothing. Then the brand drowns in "where's my box" tickets from people whose orders were never real in the first place.
So we did the thing nobody puts in a pitch deck. We built the same kind of weapon the bots use, and pointed it back at them. Every purchase had to clear a gate: verified members only, 5,000 of them, each with a one-time email code. No code, no box. A bot with no inbox hits a wall.
I'll be straight with you, because this is a war story, not a highlight reel. A few fakes still slipped through on the first pass. We spent the next day hunting them down and handed WingStop a list of the ones we were sure were fraudulent, so they'd get killed before a single box shipped to a robot. We won most of that fight. Not all of it. I'd rather tell you that than pretend it was clean.
Here's why it matters even if you never run a drop. The same tech that clears a limited release in 47 seconds is the tech behind the ADA lawsuits hitting Shopify stores right now. Those cases don't start with a shopper who had a bad experience. They start with a script. Law firms run scanners across thousands of stores a night, flagging the easy stuff: images with no alt text, buttons a screen reader can't reach. Every flag becomes a demand letter with a five-figure number on it. You're not being sued by a person. You're being farmed by a bot. Add the fake traffic quietly wrecking your analytics, and the web your store lives on gets less human every year. Most agencies build you a pretty storefront and never think about the machines attacking it. We do, because we build them too.
One of those scanners has probably already crawled your store. Reply ADA and I'll send you the tool we use internally to make sure the ADA lawyers and their bots don't stand a chance.
— Andrew
P.S. The fans who got a code got their boxes. That was the whole point. You don't run a drop for the bots. You run it for the people who set the alarm.