Blog
Deep dives into the bugs AI assistants introduce and how to catch them before they reach production.
A vendor renamed one JSON field. payload.get("fee", 0) turned every fee into zero — no exception, no log line, just 1,258 quietly wrong settlement records over two months.
Two silent fallbacks stacked: a build tool stopped generating config fields, and a greedy regex fell back to a gitignored .env. The production binary shipped without its backend URL — and nobody noticed until a tester decompiled it.
MIG0012026-07-065 minA migration revision ID one character too long, a deploy script that swallowed the failure, and a database that got force-stamped into lying about its own state. MIG001 and MIG002 exist because of this incident.
A lookup missed, a fallback quietly substituted the most recent record, and a real email went to the wrong human. No error, no log line, no stack trace — the worst kind of production bug.
One unanchored dist/ line in .gitignore silently dropped vendored JavaScript from the repo. Local worked. CI checked out a repo with holes in it. The deployed page loaded clean and did nothing.
What a single static analysis run found in a real, live, customer-facing app, and what it tells you about the way AI writes code.
A free live dashboard and native macOS notifications for Claude Code. See what every instance is doing, jump to any session instantly, never miss a permission prompt again.
Token rotation stopped three weeks ago. The nightly sync hasn't run since Tuesday. The cleanup job is throwing errors into the void. You have no visibility, no alerts, no history. Here's how to fix that.
A runaway query is eating your connection pool. Cache hit ratio dropped to 40%. Three users are locked out. You have no dashboard, no health checks, no visibility. Here's how to fix that in one command.
You integrated OAuth, launched, and celebrated. Three months later, users started getting logged out randomly. Here's what went wrong and how to prevent it.
PERF0022026-03-175 minA free timing waterfall for LLM operations. One command installs ChatTimer — wrap your prompt building, API calls, and response parsing, then visualize exactly where time goes.
RATE0022026-03-174 minAI assistants write in-memory rate limiters that reset on deploy and break across instances. Here's why that's dangerous and how to fix it with one command.
SEC0042026-02-104 minEvery AI assistant we tested uses random.randint() or Math.random() for security tokens. Here's why that's dangerous and what SEC004 catches.
DET0012026-02-075 minYour code works in dev, passes tests, then produces different results in production. DET001 catches the nondeterministic iteration that causes it.
ASYNC0012026-02-044 minCalling an async function without await doesn't throw an error — it silently returns a Promise that nobody checks. ASYNC001 finds every instance.
QUAL0042026-01-303 mindef process(items=[]): looks innocent. It shares state between calls. AI assistants write this pattern constantly — QUAL004 catches it every time.
SEC0022026-01-275 minWe found f-string SQL queries in 40% of AI-generated database code. SEC002 catches string concatenation in SQL before it reaches production.
FRONT0022026-01-234 minAI writes browser code that crashes on the server. FRONT002 finds every window, document, and localStorage access that needs an SSR guard.
CONC0012026-01-205 minif file_exists then write_file looks safe. It isn't. CONC001 catches time-of-check-to-time-of-use bugs across Python and JavaScript.
TYPE0092026-01-163 minTypeScript's non-null assertion on environment variables compiles fine and crashes at runtime. TYPE009 catches this before deployment.