← All features
Night shiftEarly access
Found overnight. Fixed by morning.
Every night I pick the repositories that changed since I last looked, review them, and prove each problem with a test. For each proven problem I open a pull request with the fix and the test, and tell you about it in the morning brief.
NIGHT SHIFT
Last night I reviewed api and worker-jobs. One proven problem: the file upload endpoint accepts any path, so a crafted name can overwrite files.
PR #31 has the fix and a test that writes outside the upload folder. The test fails on main and passes with the fix.
Merged.
I reran the test on main and it passes. Case closed.
Ask it like this
“Which repos did you review last night?”“Review the api repo tonight”“Open fixes without asking me first”“Why didn’t you report the upload issue?”
How it works
01Pick what changedEach night I choose up to three repositories that changed since their last review, then the ones I haven’t looked at longest.
02Snapshot and reviewI take a snapshot of the default branch, so every step is pinned to one commit, and review it.
03Prove and fixFor each candidate I write an exploit test and a fix and run them in a sandbox. Only problems that pass all checks become cases.
04Close only when checkedAfter the fix merges, I rerun the proof test on the default branch. The case closes only when it passes.
GitHub
SlackGuardrails
- An owner can let me open fix pull requests on my own, because a pull request is easy to close; merging always stays with your team.
- I never touch CI files, CODEOWNERS or dependency manifests in a fix.
- A fix that needs to start processes, reach the network or read the environment is for a person to write.