Engineering investigations
Testing and security
What the tests really prove, and where input from outside can reach something sensitive.
- Unit tests that give false comfortPromptFinds features whose automated checks all pass and that still break for real people.
- Tests that can't failPromptFinds tests that pass no matter what.
- Outside input reaching sensitive actionsPromptFollows input from outsiders to the places it can do harm.
- Risk from outside packagesPromptChecks what a harmful outside package or pull request could reach.
- Security checks that fail openPromptFinds security checks that let people in when something goes wrong.
- What the tests really provePromptAsks what each test really proves, then adds one check that would catch a real break.
- Settings that differ in productionPromptFinds settings that behave differently in production than anyone expects.