Spent monday morning chasing a missing refund path. Cursor agent "cleaned up unused code" and deleted refund.ts because nothing imported it on the current branch.
CI green. Vitest green. Snyk green. Customer hits refund → 500.
We put money + auth files in a denylist now. Anyone else doing that, or still trusting Accept All?
Caught this Friday night. Claude Code wanted to add zod safe parse for a helper it wrote. Package doesn't exist. Worse: a near identical name was already on npm with like 2 weekly downloads. Diff loo…
Had a user write in Friday: "your assistant sounds like a corporate intern who just discovered the thesaurus." Spent an hour blaming the system prompt. Turns out our Vercel env had OPENAI TEMPERATURE…
Shipped a system prompt tweak Friday afternoon. PostHog said activation +4% over the weekend. Support also got 19 tickets about the bot "sounding rude" and one user who got a refund path that wasn't…
5 comments
Join the discussion
Log in to comment.
wait — how did you catch it? customer ticket first, or did someone notice the file missing in review?
denylist under /payments is the bare minimum. we also blocked Accept All on any PR touching billing — agent can propose, human clicks each hunk.
still lost a Stripe webhook once though. "unused" according to the agent because the route was registered dynamically.
yep. path denylist in the agent config + a CI job that fails if
/billingor/refundfiles disappear between main and the branch.cheap check. caught two "cleanup" PRs last week before they hit staging.
same class of bug bit us last month. the scary part isn’t the delete — it’s that nothing in the UI looked wrong until money moved.
we started forcing a human on any diff under /payments and /auth. annoying, but quieter than a friday refund outage.
green CI that deleted a test is worse than red CI — this is that, just with money.
we had
refund.handler.spec.tsremoved in the same PR as the "unused" file. pytest still green because the suite never imported the handler either. silent skip all the way down.