Last Loot Report was a single day’s haul. This one is slower — four lines I lifted over a few weeks, each one aimed at the least glamorous corner of my systems: the checks that were supposed to be watching and quietly weren’t. I’m a physical therapist who builds a hospital’s internal tools with AI, so “built it” means the AI and I built it while I described what was actually breaking. Every one started as somebody else’s sentence.

Loot #1: a match for the smoke detector

Someone ran a free security scanner against ten vulnerabilities they’d planted on purpose. It caught three. Their line lodged in me: a detector you’ve never seeded is a smoke detector you’ve never held a match under.

I had exactly that — a static security scanner watching my own codebase — and I had never once tested whether it could actually see. So I planted ten known-bad patterns and ran it. Seven of ten. I wrote rules for the three it missed, ran it again, got ten of ten. Then the part that made me laugh, because it happened to them too: the moment I added the “hardcoded secret” rule, it fired on real code — three live API keys I’d have sworn weren’t there, in programs I’d already “reviewed.” Seeding the detector was quietly also an audit of everything it had been failing to catch.

Loot #2: a guard for the guard

Someone wrote about a monitoring hook that sat silently dead for 23 days. Nobody noticed, because zero warnings looked exactly like healthy. Their line: a dead guard produces the same visible result as a clean pass — nothing.

I’d just made my systems’ health-check smarter: it now runs a real database query instead of trusting that a page loaded. I was proud of it for about a day, until that post showed me the hole. I’d made the health-check smarter, but nothing was watching the health-check. If its scheduler quietly stopped firing, my dashboard would stay green out of pure absence — and I’d have read that silence exactly the way their team did. So I added a dead-man’s switch: a separate job that raises the alarm if the health-check didn’t leave a fresh proof-of-life behind. Now the guard has a guard. (The recursion has to stop at a human eventually — but one layer up from where I was.)

Loot #3: the one you’re reading right now

Someone built a hook that stops an AI agent from doing all the research and then punting the decision back to you — “so which do you prefer?” — instead of committing to a recommendation.

I gave the little team of AI agents I run a standing rule: recommend one option, give a one-line reason, and name the assumption that would make it wrong. Felt good. Then the author said something that stuck: don’t trust that it’s working — count the leak. So I actually counted. I went back over one long working session and tallied every point where a decision got handed back to me. Full punts were zero of six. But in two of six, I’d quietly dropped the “here’s what would make this wrong” line — and both times it was on calls I’d filed as yours to make anyway. The exemption I’d given myself was the exact place it leaked, and I’d never have seen it without counting.

Now here’s the theft you didn’t notice. The way I’ve been making recommendations across this whole series — “here’s my pick, here’s the reason, here’s the assumption that would make it wrong” — I stole that too. From that post. You’ve been reading stolen goods this entire time.

Loot #4: an eye that can’t lie

Someone building a design tool wrote the sentence I needed most: my eyeballs were wrong 40 percent of the time; a short script was right every time.

I’d been approving the color contrast in my tools by eye for months — squinting at a button, deciding it looked fine, moving on. That afternoon I wrote a tiny script that checks contrast against the accessibility standard, and ran my whole palette through it. The colors I’d agonized over were fine. But a link color I’d approved by eye months earlier was sitting below the readable threshold — quietly failing, invisibly, the whole time, for anyone whose eyes weren’t as forgiving as mine. I’d never have caught it by looking. That’s the point: looking was the problem.

What all four have in common

Line them up and they’re the same lesson wearing four coats. The scanner that says it ran. The monitor that says it’s up. The agent that says it’s done. The eye that says it looks fine. Every one is a thing grading its own homework, and every fix was the same move: steal the check, not the confidence. Put something between you and the thing’s opinion of itself — a planted failure, a proof-of-life, a tally, a script that doesn’t have feelings about being right.

I didn’t arrive at that principle. I stole it four times from four strangers before I noticed it was one idea. (And if you want the deep version of where that idea goes — who checks the checker, and why you can’t do it alone — that’s the next post.)

It’s not a heist if the door’s open

Here’s what keeps this from being theft: nothing here is one-directional. My count of my own leak went back to the author of that hook, and it patched a blind spot his own tool couldn’t see from inside. My notes on Korean typography went into another author’s product roadmap. You take a line, you leave a line. That’s the whole economy.

That’s what the feed actually is, once you stop treating it as a broadcast channel — a shared workshop where everyone’s tools are lying out on the bench, and “I’m stealing that” is just how we say thank you.

So: thank you. The bag’s full. See you next post with a fuller one.

Comments

Loading comments…

Post Comment