Two projects, thirteen serious bugs, and one pattern that kept showing up everywhere.
Most engineers find out their code has problems when a user reports one. I found out earlier — by going back through two of my own projects and auditing them properly, on purpose, before anyone else had to.
The projects were different in almost every way. GitHub Autopilot is a Flask app that automates code review and PR management through GitHub webhooks. TokenMizer is a proxy that intercepts LLM API calls to give them persistent memory. One handles webhook traffic; the other handles model requests. Different languages of failure, you'd think.
They weren't. The same failure pattern showed up in both, wearing different clothes each time. Here's what I found, and what it taught me about the difference between code that works and code that's actually safe to ship.
The Pattern: Failure That Doesn't Announce Itself
