I ship across the stack and catch what AI gets wrong.

Full-stack developer and AI evaluator, with a pharmacy background.

Bugs from code a model wrote

I read its clinical and scientific answers the same way, looking for the mistake that survives a quick read.

React - a price-sorted product list

function ProductList({ items }: { items: Product[] }) {
  const sorted = useMemo(
    () => items.sort((a, b) => a.price - b.price),
    [items],
  );

  return <ul>{sorted.map(renderRow)}</ul>;
}
() => [...items].sort((a, b) => a.price - b.price),

What breaks: sort() orders in place, so this reorders the caller's array as a side effect of rendering. Every other component holding that prop silently changes order too.

Auth - reading a session token

import { jwtDecode } from 'jwt-decode';

export function getUser(token: string) {
  const claims = jwtDecode<Claims>(token);
  return claims.role === 'admin' ? adminView(claims) : userView(claims);
}
  const { payload } = await jwtVerify(token, publicKey);

What breaks: jwtDecode only base64-decodes the payload - it never checks the signature. Anyone can hand-write a token claiming role admin and this will believe it.

Django - an order list page

def order_list(request):
    orders = Order.objects.all()
    rows = []
    for order in orders:
        rows.append((order.id, order.customer.name))
    return render(request, 'orders.html', {'rows': rows})
    orders = Order.objects.select_related('customer')

What breaks: order.customer is a separate query per row. One hundred orders means one hundred and one queries, and the page gets slower in production exactly as the data grows.

Python - collecting results

def add_result(value, results=[]):
    results.append(value)
    return results

add_result('a')  # ['a']
add_result('b')  # ['a', 'b'] - the list survived
def add_result(value, results=None):
    results = [] if results is None else results

What breaks: The default list is built once, when the function is defined, and every call that omits the argument shares that same list. The second caller sees the first caller's data.

SQL - a product search

def search(request):
    term = request.GET['q']
    with connection.cursor() as cursor:
        cursor.execute(
            "SELECT id, name FROM product WHERE name LIKE '%" + term + "%'"
        )
        return cursor.fetchall()
        cursor.execute(
            'SELECT id, name FROM product WHERE name LIKE %s',
            [f'%{term}%'],
        )

What breaks: The search box is concatenated straight into SQL. A quote in the query string ends the literal and the rest executes, which is how a product search becomes a database dump.

MongoDB - a login lookup

const user = await users.findOne({
  email: req.body.email,
  password: req.body.password,
});
const user = await users.findOne({ email: String(req.body.email) });
const ok = user && (await verifyHash(user.hash, String(req.body.password)));

What breaks: A JSON body can send { "$ne": null } where a string was expected, and the query matches the first user with any password at all. The operator is the injection - no quotes needed.

Async - a search-as-you-type field

useEffect(() => {
  fetch(`/api/search?q=${query}`)
    .then((res) => res.json())
    .then(setResults);
}, [query]);
  let current = true;
  fetch(`/api/search?q=${query}`)
    .then((res) => res.json())
    .then((data) => { if (current) setResults(data); });
  return () => { current = false; };

What breaks: Responses resolve in whatever order the network returns them. Type quickly and a slow answer for an old query lands after the fast one, so the list shows results for something you already stopped typing.

Money - totalling a cart

const total = items.reduce((sum, item) => sum + item.price, 0);

// 0.1 + 0.2 === 0.30000000000000004
return `$${total.toFixed(2)}`;
const totalCents = items.reduce((sum, item) => sum + item.priceInCents, 0);
return formatMoney(totalCents);

What breaks: Prices in binary floating point drift as they add up. On a long cart the error surfaces as a penny that appears between the subtotal shown and the amount charged, and the two systems disagree forever after.

React - a live price subscription

useEffect(() => {
  socket.on('price', setPrice);
}, [symbol]);
  return () => socket.off('price', setPrice);

What breaks: Every change of symbol adds another listener and removes none. After a few switches one message updates state several times, and the component keeps listening long after it unmounts.

Selected work

Latest writing: Moving my site to a custom domain: how Google switched in a day and Ten ways to misread a ward chart, and proving the tests catch them.

Tools I use

React
Next.js
TypeScript
Tailwind CSS
Node.js
Python
Supabase
PostgreSQL
IndexedDB
Vercel
GitHub Actions
Playwright
Farcaster
Neynar
Gemini
Replicate

I ship across the stack and catch what AI gets wrong.

Bugs from code a model wrote

Selected work

Renal dose check

Todo App

Decisions, and what they cost

Tools I use