When a subscriber disappears from a list, nobody gets an error. The campaign sends, the contact count is one fewer than expected, and unless someone is watching very carefully, you might never know you lost a subscriber who had nothing to do with that send.
This is about a bug I found in my own code that did exactly that. It lived in a bounce handler, invisible to every test I wrote and every review pass I ran — including one where I explicitly sat down to look for security issues.
This is Part 3 of a series on building a multi-tenant email service with FastAPI and Resend.
Part 1 — Building the service: one Resend account, multiple customer domains, contacts, segments, campaigns.
Part 2 — Making sends safe to retry: idempotency keys, per-recipient status tracking, the chunk key that was never actually retried.
