By Epiphanus Obia
Emmanuel Taiwo spent six days and over ₦20,000 building 9jaCheckr, a free NAFDAC verification API and Telegram bot. It reached 1,500 users and 115 developers before a silent government intervention shut it down. To date, NAFDAC has said nothing.
Typing an emoji, a space, or even a series of incoherent characters into a government food and drug verification portal should return an error or a prompt stating the input is invalid. What it should not do is reach into a national database of pharmaceutical products and return data for a random product.
But that is precisely what Nigeria’s NAFDAC verification portal was doing in March 2026. Emmanuel Taiwo, a software engineer, called public attention to the flaw by posting a thread on X (formerly Twitter) highlighting the issue and offering a fix. In response, the agency scrambled to patch the portal within hours—yet remained silent on the tool Taiwo had built to help Nigerians.
From Lockdown to Builder
Taiwo’s journey into coding mirrors that of many Gen Zs. During the 2020 COVID-19 lockdown, he began learning Python and web development. He eventually transitioned from a student to a builder, someone who creates tools to solve practical, everyday problems.
“I just build projects that people love using. I enjoy building things that help people solve their day-to-day problems,” Taiwo said. “
By March 2026, he had shipped over ten such tools. Most found modest success, but none prepared him for the drama surrounding his product verification project.
A Tweet, a Two-Day Build, and 50,000 Engagements
On March 19, a doctor posting under the handle @the_beardedsina proposed an idea on X: Could someone build an app allowing Nigerians to scan a drug to instantly verify if it was genuine? The post went viral, sparking a technical discussion with developer @hackSultan regarding why the architecture would require more than simple barcode scanning.
Taiwo saw the challenge and took it on. By the following day, a working Telegram bot was live. By March 21, a full REST API with documentation was available at 9jacheckr.xyz, free for any developer to use. He named it 9jaCheckr, a name coined with the help of ChatGPT.
The concept was straightforward: NAFDAC already maintained a public web portal for product verification, but it was clunky, lacked a user-friendly interface, and offered no official API for developers. Taiwo’s system automated the process a human would take on the NAFDAC site, extracted the details from the HTML, and served them as clean, structured data.
“I did not really expect it to blow up like that,” Taiwo told ITPulse. Within 24 hours, his post had 50,000 engagements. During its four-day lifespan, the project saw 1,568 Telegram users and 115 developers integrating the API. It facilitated 1,880 verifications and generated zero revenue.
What the Data Revealed
Even before the emoji glitch was discovered, 9jaCheckr surfaced uncomfortable truths. Taiwo revealed he had switched butter brands months earlier after noticing that Golden Penny butter’s certification appeared as expired on the NAFDAC portal.
Once 9jaCheckr went live, multiple users independently replicated this finding. Taiwo was careful to clarify that an expired certification does not necessarily mean a product is dangerous; it could mean the portal is outdated or the renewal is pending. However, the lack of clarity remains the core issue. One company even reached out to Taiwo privately, stating their renewal had been processed months ago, yet the portal failed to reflect it.
ITPulse verified the Golden Penny Spread finding on April 6, 2026. Entering registration number 08-0889 into NAFDAC’s primary portal returned a warning: “Product certification has expired.” According to the site, the certification expired on August 5, 2025. Meanwhile, a search of the NAFDAC Greenbook, the agency’s second verification portal, returned no record for that number at all. The two systems, both maintained by NAFDAC, continue to provide conflicting results.
The Flaw He Could Not Ignore
On March 25, Taiwo posted a thread that changed the trajectory of the project. He discovered that NAFDAC’s portal performed no server-side input validation. Typing a space or an emoji returned random product records, some of which had no NAFDAC number at all.
Taiwo provided a methodical breakdown of the flaws and technical recommendations for fixes, tagging NAFDAC directly. While this bypassed the standard responsible disclosure protocol, where developers notify organizations privately first, Taiwo argued his reasoning was pragmatic.
“I believed they would not respond to me if I tried messaging them privately,” he explained. “But the issue was not a critical vulnerability that exposed personal data. If it had been that serious, I would have messaged them privately.”
NAFDAC patched the flaw the same day the post went viral, without any public acknowledgment of Taiwo’s contribution.
The CAPTCHA and the Quiet End
The end of 9jaCheckr came not with a legal cease and desist, but with a CAPTCHA. On March 26, NAFDAC added the bot-blocking tool to its portal.
Taiwo noted that he had checked NAFDAC’s terms of service and confirmed that while scraping (aggressively extracting data) was prohibited, his method of automation was not explicitly barred. Regardless, the CAPTCHA broke his system.
“It’s their way of telling me they don’t want me to automate their website anymore,” he said. He shut down the bot and API immediately, posting a gracious farewell to his users. Interestingly, shortly after 9jaCheckr went offline, Taiwo noticed the CAPTCHA had been disabled. The message had been delivered without a single word being exchanged.
The ₦0 Balance Sheet
The project was a labour of love and a financial loss. Taiwo spent roughly ₦25,000 on servers, a domain, and AI models for image scanning. Although he set up a Paystack payment wall to help cover scaling costs, no one subscribed to the pro tiers.
₦10,000 per month. Nobody subscribed to the Bot Pro plan at ₦500 a month. One person sent ₦2,000 as a voluntary gesture of support.
Total revenue: ₦2,000. Total expenditure: above ₦20,000, plus six days of his time.
“I made a total of ₦0 from it,” he wrote when he announced the shutdown. “Big thanks to everyone for the encouragement, and even the haters for the engagement. We move on.”
A Pattern of Silence
Taiwo originally envisioned 9jaCheckr as the first step in a larger project: a developer-friendly layer for Nigerian government data, including CAC and SON records. That vision is now shelved.
“Since NAFDAC was not successful, there is no point in going ahead with others,” he said, expressing frustration at a government that seems to respond to social media noise but ignores innovative builders.
ITPulse sent a formal enquiry to NAFDAC’s public affairs unit with 12 questions regarding the vulnerability and the agency’s policy on developer access. No response was received by the time of publication.
For now, the fake drugs remain in the market, the portals remain inconsistent, and one of Nigeria’s promising young engineers has stepped back from civic-minded building. As Taiwo told other young developers: “Keep building… and keep trying to make change.”