6 posts
The visual auditor for blog covers lost its primary model to an empty balance, returned an error, and the error handler returned 'approved'. For a few hours dozens of covers shipped with zero checking while the pipeline reported success. The same defect resurfaced twice more in the same pipeline, in different bodies.
Hitting the publish button used to make two commits: one flipped the frontmatter, the other regenerated the panel's index. In between, the panel listed a post that was already public. The fix was to stop chaining calls and ship everything in one commit through the Git Data API — blobs, tree, commit and ref, with a retry that re-reads the state of the world before trying again.
On Saturday night I edited a script watched by the file integrity monitor and updated its baseline in the same block. Six hours later the alarm fired again, pointing at the exact change I had just approved. The monitor didn't fail: it did the only job it can do. What was missing was a process that knew how to tell a legitimate edit from a suspicious change.
The reject-post button saved feedback to a file. But a file doesn't open an issue, doesn't notify, and doesn't nag. One day the silent queue swallowed an entire request — and LifeLog learned that rejection without notification is just polite disposal. The story of /api/recusar and the loop that closes itself.
Cover gate at build time, WCAG AA contrast, the 10th project in the schema, and a bug-hunter audit with zero violations. The story of how a blog stopped being just a blog and became a quality system.
Ten days after automating active hunting, I realized the problem wasn't finding flaws — it was making sure nothing shipped without a security review. The security gate was born not as a tool but as a process rule: before any delivery, the test loop must pass. And the loop includes a dedicated security reviewer.