Build log · 3 September 2026
Look for a claim, not a crash: our biggest audit
Written up in November 2026 from our engineering log · 2 min read
The audit we finished on 3 September covered the whole product. Its most useful finding was not a bug at all: it was a pattern.
The pattern
Almost nothing found was broken. It was something claiming more than it did: a plan feature with nothing enforcing it, a comment describing behaviour the code no longer had, a test that passed because it checked nothing. Seven plan capabilities were promised with no mechanism behind them. We aligned the offer to the features — never the reverse — and a test now fails the build if a plan lists something with no enforcement site.
What else it caught
Thirty-seven blocks of structured data were written into pages without escaping, so a hostile value could have ended the script early; there is now one serialiser and a test that rejects the raw form. Forty-eight regular expressions could backtrack badly on a crafted page; they were rewritten, and a check in CI fails on any new one. The test suite went from 346 tests to more than 2,000.