Some bugs hide in logic. This one hid in the gap between "the code looks correct" and "the code is actually working" and the only way I found it was by refusing to trust either claim without checking the live system directly.
The setup
Mid-migration between two credential-storage systems: an older secrets vault (call it the legacy vault) used by an original provider integration, and a newer, purpose-built vault for a self-hosted replacement being rolled out gradually. During the transition, both exist side by side. The code that decides which vault to check for a given user's credentials looked, on review, completely correct it classified each connection record as "legacy" or "new" based on a stored field, and looked in the matching vault.
Nothing about the code review raised a flag. Which is exactly the problem with code review as your only line of defense: it tells you the logic is internally consistent, not that the systems it's talking to still exist.
Building the audit, properly this time
