Skip to content

docs: record the four conventions the audits kept re-deriving - #411

Merged
arzafran merged 2 commits into
mainfrom
docs/audit-conventions
Aug 5, 2026
Merged

docs: record the four conventions the audits kept re-deriving#411
arzafran merged 2 commits into
mainfrom
docs/audit-conventions

Conversation

@arzafran

@arzafran arzafran commented Aug 5, 2026

Copy link
Copy Markdown
Member

Closes #399.

What this does

Four audits arrived at the same positions independently, and each one exists because the alternative already shipped a bug. They lived only in issue history, so the next audit would have rediscovered them from scratch. Now they are in AGENTS.md, next to the rules people already read.

Summary

  1. A comment calling something deliberate must say what it costs. Two real defects survived review behind intent-only comments: form actions verified Turnstile before rate limiting, and the Sanity live module claimed published fetching was unaffected by a missing token when it was entirely disabled by one.
  2. "Is X configured" has one answer per integration. Where the modules cannot be merged — the Sanity env module is dual-compiled and must not import server-only code — a test keeps them in sync instead. With the non-obvious part recorded: reading the same module is not sufficient, because a dual-compiled module answers differently per side when its fallbacks are not statically inlinable.
  3. Anything a scaffold step did not expect blocks self-prune. setup:project had three failure modes — thrown, collected, skipped — and only a thrown one stopped the run.
  4. Ship the claim with the fix. The rule with the worst track record here — a changelog and an audit report both credited a PR with a fix covering one of the three scripts it named.

Also adds a line to the PR template for the fourth, since it is the one that slipped twice and the moment it matters is the moment you open a PR.

Test Plan

  • bun run check → exit 0 (docs and template only, no code)

Adding to an empty cart from two tabs at once made each request create its
own cart. One cookie won and the other cart, holding an item the buyer had
just added, was orphaned.

Serverless invocations share no state, so the coordination happens in the
one place the requests do share: the browser. A cross-tab Web Lock funnels
cart creation through a single idempotent request. The cart id stays in an
httpOnly cookie and never reaches client code, since Shopify's cart id
embeds a secret their docs say to treat like a password.

The server action still creates a cart when the cookie is missing, so a
submission without JS keeps working.
Copilot AI review requested due to automatic review settings August 5, 2026 17:52

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

@vercel

vercel Bot commented Aug 5, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated (UTC)
satus Ready Ready Preview Aug 5, 2026 5:52pm

@arzafran
arzafran merged commit 0d53711 into main Aug 5, 2026
12 checks passed
@arzafran
arzafran deleted the docs/audit-conventions branch August 5, 2026 17:55
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Epic: five structural themes behind the 2026-08-05 audit findings

2 participants