8 posts tagged this topic.
AIDA's Settings AI Features form blocked Save with a "Select a model" error right after switching providers. The real defect sat two React commits away, inside a hidden native select Radix uses to bridge into native form submission — and it never raised an error of its own.
A Google Reviews listing-confirm route taught me that 'it saved' and 'everything it triggered afterward also worked' are two different claims, and a response body should never merge them into one.
Fixing a cross-tenant IDOR taught me that 'access denied' and 'does not exist' are the same message when the requester should never learn which one is true.
AIDA classifies support tickets with an LLM, so the classifier has to treat every ticket as a potential attack. The fence around the ticket text is real, but it isn't the guarantee — the guarantee is that a successful attack still can't do anything.
AIDA's outbound email job derives References and In-Reply-To by querying every prior email-bearing message on the ticket. On a retry, the message being sent already has its own Message-ID persisted from the failed first attempt — without an explicit exclusion, it would show up in its own References chain.
Every webhook integration works in the demo. Production loses events in the silence after you reply 200 — so I built OmniSync around one guarantee: once an event is acknowledged, it is never silently lost. At-least-once delivery, idempotent everything.
AIDA's public intake route checks content length, per-file size, a running total, and byte-sniffed MIME type before saving an attachment. None of that mattered once Next.js's own proxy layer silently truncated the request body first, with no error back to the client.
An AI agent blamed a failing Playwright test on Next.js response caching. I traced the code and blamed middleware. We were both wrong about the observation: the test's "anonymous" context was quietly authenticated. Two stacked bugs, two confident stories, and the re-run as the only reviewer that counted.