Greg Loring and GSL Design: a dated record.

01 · Background

Why CoreShift was brought in

CoreShift originally built the infrastructure these websites run on: the server, nginx, WordPress and the hosting stack. GSL Design then deployed a theme on top of it.

The websites belong to CoreShift’s client, Dr. Baig: Baig Medical Group, RF Supplements and RFS·RX. When the client declined to let his developer dictate the direction of his own website, Greg Loring still held the WordPress administrator account. In effect, the client could not change his own website without his developer’s permission.

Requests the client had made were answered with “no, that’s impossible.” Those things are now live.

The client sought CoreShift out. CoreShift built a new server, migrated the sites onto it intact and cut DNS over. Greg Loring was still on the site’s administrator account in August, when he asked to be taken off it (exhibits 06 and 07).

02 · The work

What was there when CoreShift took over, and what was fixed

The work on rfsupplements.com, by date, since CoreShift took it over:

Server and backups

• Sept 16Moved to a new AWS server.
• Sept 17Nightly S3 backups, nightly disk snapshots, and on-demand snapshots before risky changes.

Security

• Sept 17Blocked bots posting to checkout. They were creating failed orders and Authorize.Net fees.
• Sept 18The REST API had been publishing administrator names and login slugs. That is closed, and the WordPress version is hidden.
• Sept 18Login rate limiting.
• Sept 18Security headers on every response.
• Sept 18robots.txt fixed.
• Sept 22Import files and WooCommerce logs containing customer order data had been downloadable by anyone. They are locked down. Only the Meta/Facebook and POS product feeds, which are meant to be public, were kept open.

Staging site

• Sept 19Built a preview site, a scrubbed copy that cannot send mail, take payments or call shipping services.

Design, all live

• Sept 17Tidied the checkout payment row.
• Sept 18Elementor taken out of Safe Mode.
• Sept 19Homepage hero reduced from a 2.22 MB image to 173 KB on desktop and 122 KB on phones.
• Sept 19Cleaned up the Shop Products menu.
• Sept 19Fixed contrast on the Athlete Program page.
• Sept 20Full redesign of every page, checkout included.
• Sept 23Mobile menu links had been invisible; fixed.
• Sept 25Footer credit changed from GSL Design to CoreShift Technologies LLC.
• Oct 1Footer now reads “Website Rescued and Maintained by”.

SEO and AI discoverability

• Sept 19robots.txt names 20 AI crawlers.
• Sept 19An llms.txt file is served.
• Sept 19Author and organisation details added to the site’s search markup.
• Sept 19Homepage heading levels fixed with no visual change.

Email and store settings

• Sept 26The former vendor’s address was still receiving three of the store’s automatic emails. All now go to the client.
• Sept 26His PayPal receiving address was cleared.
• Sept 26Store address set, and the store’s base location corrected from Arizona to California.

Connected to the operations system

• —The operations system has its own account to read and update the store.
• —Every form submission now becomes an inquiry there. Before this, the forms saved nothing.
• —Shipping labels and product edits are done from it.

RFS bot

• —CoreShift created the RFS bot, which gives full interaction with the website, the store, shipping and the operations dashboard. The client can check sales figures and trending items, adjust stock, register new products and run inventory, and it automates contact responses, email campaigns and abandoned-cart outreach.

03 · August 7 and August 10, 2026

The slurs he sent our client

In August, Greg Loring was still on the website’s administrator account and was receiving its automatic notices. These two messages were sent while he asked to be taken off it. Both screenshots contain a racial slur or racially directed abuse and are behind a warning.

Exhibit 06Fri, Aug 7, 2026 · group thread: Greg Loring, the client, Darrin Abell

Can either of you two dip shits figure out how to take me off of the admin account so I don’t get these anymore?

Sent with a forwarded WordPress error notice. After the client replied, he wrote “Fuck off” and sent a dark-skin-tone middle-finger emoji.

Contains a racial slur and abusive language. Select to view the screenshot.

View the screenshot

Exhibit 07Mon, Aug 10, 2026 · 9:17 AM and 3:47 PM

Get your shit together and remove me from the admin.

Sent at 9:17 AM. After he had been removed, he wrote about Dr. Baig, in a thread Dr. Baig was on. The message is in the screenshot behind the warning below, and it is exactly what the warning says.

Contains a racial slur and abusive language. Select to view the screenshot.

View the screenshot

04 · July 7 and September 30, 2026

The threats

Exhibit 04Tue, Jul 7, 2026 · from 4:44 PM · his thread with the client

I hope you’re this cocky when I see you in person. My guy

He had demanded payment (“Pay me what is owed to me.”). The client answered that the check had been mailed the week before. This was his reply. His next message began “Fired? Give me a break. You’re such a dumb fuck.”

Exhibit 11Wed, Sep 30, 2026 · 5:07 PM · CoreShift contact form

Yo dipshit! You need quit claiming web development on sites you didn’t do, you fucking clown.

Submitted through the contact form on coreshift.technology, signed “Greg”, with the email address greg@punchyoface.com.

Exhibit 10Wed, Sep 30, 2026 · 5:16 PM

What the fuck are you claiming design and development you dumb fuck.

You’re begging for it

Sent beneath a screenshot of the RF Supplements footer.

Exhibit 09Wed, Sep 30, 2026

i can’t wait to see your ass in person

You cunt

Sent beneath screenshots of three cards from the CoreShift showcase.

05 · July 7 and September 30, 2026

The abuse

Exhibits 01–02Tue, Jul 7, 2026 · his thread with Darrin Abell

He asked whether his access had been removed before anyone checked that he had been paid. CoreShift replied that it did not want to be in the middle of anything between him and the client, that the client owns and controls his own domain, and that the client said he had paid before any DNS change. This was his answer:

You involved yourself by doing that. I haven’t been paid. And you can go fuck yourself!

Exhibit 03Tue, Jul 7, 2026 · his thread with the client

The client wrote that a check would go in the mail when he was back in town, that this was his last and final response, and asked not to be messaged again. His reply:

Wow - you’re a complete piece of shit.

Exhibit 08Wed, Sep 30, 2026

His message opened with an offer:

I’m going to give you the opportunity to correct this privately before I address it publicly.

The message that followed it:

You are a shady ass mother fucker.

06 · July 14 and October 1, 2026

FieldPins

Publishing proof of completed jobs, with photos and locations, to a business’s website so that search engines can find it is an established product category. DataPins and others already sell it. Greg Loring’s name for it was FieldPins.

CoreShift built the working pipeline. By June 12, 2026 it ran end to end: job intake, automatic privacy scrubbing of every photo, written descriptions and alt text, a human approval gate so nothing publishes unreviewed, and publication to the client’s website, with ranking measured alongside it.

Exhibit 05Tue, Jul 14, 2026

It’s in your best interest to remove this immediately.

Sent with a search result showing the FieldPins name on fieldpins.m8n1ac.com. CoreShift removed the name.

CoreShift’s product is JobTrace.

On October 1, CoreShift compared every line of its JobTrace copy against everything FieldPins publishes on fieldpins.io. No sentence was copied. The longest shared run was five ordinary words. A few lines did echo the FieldPins tagline in shape, and CoreShift rewrote them anyway.

07 · Where this stands

The record

Every message on this page is preserved in its original thread. Any further contact should be in writing.

Anyone who wants to see what CoreShift builds is welcome to look at the work itself.