Patterns.

A component whose bug-class keeps recurring. Patches address symptoms; the design holds the primitive.

A capability is implemented by two or more parallel modules (per adapter, per runtime, per deployment target). The canonical module imports a security check from a shared utility and enforces it; a divergent module, written separately for a different environment, never imports it. Both expose the same client-facing contract; one is gated, the other is not. The CVE names the divergent module.

The bug class is too fundamental to the design. Patches close instances; the primitive remains.

External content feeds an interpreter that treats it as instructions. Prompt injection is one instance.

The tools and credentials that authorize access to your systems are now the attack surface.

A header, query parameter, or environment input the framework defines as internal-IPC-only, read with security-relevant authority on every inbound network request. The "internal-only" contract is documentation, not enforcement.

Vendor discloses only after active in-wild exploitation. The gap between first-seen and CVE is the story.

No auth required to write a file into a path the server executes. Webroot upload, CGI drop, etc.

A security check inspects an input for a forbidden form. A downstream subsystem canonicalizes the same input (URL decoding, path-parameter stripping, Unicode normalization, escape resolution) into that forbidden form. The check sees the wrapped representation; the action sees the unwrapped one. The fix is to canonicalize before checking, never after.

The fix was in a comment. The code shipped without it. Audit your oldest TODOs.

The sandbox, scanner, or SOC tool is itself the attack surface.

A security filter and a downstream sink each parse the same input through their own matcher. The filter's grammar is strictly contained within the sink's. Inputs the sink accepts but the filter does not match flow through unfiltered, reaching the sink that runs them. The two matchers were written to describe the same syntactic object and did not agree.

Security gate can't decrypt/validate a message and forwards it anyway. Logs the failure, does the action.

CSRF tokens mistaken for authentication. Valid nonce does not equal authenticated caller.

A library exposes sanitization as opt-in flags with unsafe defaults. A caller wiring the library's output into a sink that interprets the result as code (raw HTML, SQL, shell) accepts the unsafe defaults by reaching for the library's static or factory helper instead of constructing the instance and setting the flags. The flags exist in the library; the fix is to set them.

A PoC that ships a full weaponizer behind a 'for authorized testing only' disclaimer.

An exploit script published against an existing CVE, structured as a working exploit but with one or more critical parameters marked as placeholders the user must adjust. The author lacks the underlying primitive; the artifact attaches authorship to a CVE-shaped wrapper rather than to a working exploit. A scanner polling GitHub for CVE-named repositories registers it as "PoC available"; the script's own comments confirm the registration is wrong.

The privileged action of your security tool becomes the attack. Defender's hands become attacker's hands.

Individually safe components that compose into an attack. Nobody owns the intersection.

A specification, RFC, or framework convention implies that an attacker-controllable field takes one of a constrained set of values, by how the spec exercises the field elsewhere rather than by formal grammar. The implementation parses the field at its broad syntactic type and accepts everything the type permits. The implicit allowlist exists in the spec authors' heads and in downstream consumers' assumptions; the code never installed it. The patch closes the demonstrated chain by narrowing the value set against the immediate context; the set of accepted values remains whatever happens to be supported by the surrounding subsystems today.

A handler given a caller-supplied identifier checks that the named resource exists and treats the existence check as the authorization decision. The identifier is enumerable; the resource carries no per-call credential. Anyone who can guess or enumerate the identifier becomes the authorized caller.

A sanitization function is named, implemented, and documented for one interpreter (the POSIX shell, an HTML renderer, a SQL dialect) and applied uniformly to inputs that flow into a different interpreter with different parsing rules. The quote-wrap survives the named sink intact, then is fed via pipe, stdin, embedded call, or template into the actual sink, which sees a literal character the wrap was not designed to neutralise. The function's name encodes the threat model the developer was thinking about; the destination encodes the one they were not.

A repository whose documentation describes a project layout — file names, command-line flags, release history, build instructions — that does not match what the repository contains. Each artifact is internally consistent because each was generated from a separate prompt; no artifact references the others because no prompt asked the model to make them coherent. A scanner that polls GitHub for CVE-numbered repositories registers the documentation as evidence of a PoC; the directory listing the documentation describes does not exist on disk.

A high-severity CVE under remediation deadline pressure attracts a throwaway GitHub account that publishes a detailed README describing an exploit. The repository contains no exploit code; the file is gated behind a no-refunds crypto paywall. The asset being sold is the defender's urgency, not a working primitive.

Code composes a standard-library path-joining helper (filepath.Join, path.join, os.path.join) with a base directory and a caller-supplied path segment, reading the composition as a sandbox primitive. The helper's documented behavior is to clean `..` segments from the joined path; a caller-controlled segment with enough `..` walks the resulting absolute path outside the base. The function name and surrounding code treat the operation as scoping; the standard library defined it as normalizing. Sandboxing requires post-join verification, filepath.Rel with a prefix check or strings.HasPrefix(base + separator). Join alone provides none.

A field stored as a generic map (interface{}, JSON, dict) whose conventional name implies a constrained shape (an ID, a path, a number). The producer's contract is implicit in the name; once an API exposes write access, the consumer reads attacker input where it expected server output.

A parser written for a "trusted" bus (CAN, internal IPC, on-prem VLAN) accepts framing fields as if the protocol's valid-range constraints were guaranteed by the medium. Sequence numbers, length fields, and indices arrive without bounds checks because the developer's threat model excludes adversaries on the wire. When the bus admits a malformed frame, the protocol-derived constant becomes the size of the overflow.

'We weren't breached' via a narrow reading of their own terms. Non-denial denial.

A shell command, SQL query, or template string is assembled by interpolating an untrusted value between literal quote characters typed by hand into the surrounding source-language string literal (`'$var'`, `"$var"`). The author has encoded the destination's string-quoting convention as a character in the source rather than as a call to the destination's escape primitive (`escapeshellarg`, prepared-statement binding, the language's `quote()`). The character is not a function: a delimiter byte inside the interpolated value terminates the wrap and the destination's command grammar resumes from the next byte. The destination's runtime exposes a real escape primitive and the same project has used it elsewhere; the bug site reaches for a typed apostrophe instead.

A function applies escape/quote/sanitize logic to user-controlled fields the developer perceives as security-sensitive (credentials, passwords, tokens) and omits it on a field that actually flows into the dangerous interpreter (shell, SQL, format string, eval). The mitigation logic in the same function is proof the developer understood the threat; the unsanitized field is proof they sorted by perceived field sensitivity rather than by destination.

A server signs a bearer token with a key the caller provides on the request, then accepts that same caller-supplied key on verification. The signature binds only that the caller could ask for issuance, not that they held any credential.

A forwarding component copies its entire inbound structure into its outbound call by default. The component's reference documentation enumerates the configurable surface and is silent about the rest. Operators reason from the narrow description; the wide default ships their inbound credentials, cookies, and headers across the service boundary unannounced. The fix is an opt-in allowlist, and the same commit adds the documentation paragraph that finally describes the default. The wide forwarding remains the default.

A security token is derived by running a cryptographic hash over a low-entropy value (a timestamp, a counter, a username, an autoincrement primary key). The cryptographic strength of the hash function is treated as compensating for the predictability of the input. It does not. The hash is a deterministic function; the output's entropy is bounded by the input's entropy, regardless of how the bits are spread across the digest.

Single maintainer account gates publishes to millions. One compromise ships to every downstream.

A security predicate intends to test one field of a structured value (a path, a header, a claim) but is implemented against the value's stringified form. The string representation includes other attacker-controlled fields, and the substring or equality check accepts the gate's allow-string from any of them.

A library accepts a security-relevant flag from its caller and overrides it inside a wrapper layer when the underlying framework's safe response to the caller's setting returns a generic fallback type. The library re-invokes the framework with the flag inverted. No log, exception, or callback informs the caller. The flag has the API surface of an enforced control and the runtime behavior of a hint.

A coordinated multi-branch release ships a security fix on one branch and ships the unfixed code on the others. The CVE record covers all branches; the patch covered the one.

The capability the researcher didn't ship tells you what the capability is. Read what's commented out.

A wire format declares a container's size in a length-or-count field. The parser materializes the container by passing that field directly into the runtime's default size-parameterized constructor (`new Array(n)`, `Vec::with_capacity(n)`, `make([]T, n)`, `calloc(n)`). The runtime's default allocates eagerly. The wire field's bytes scale with the digits used to encode the size; the allocation it triggers scales with the value those digits encode. Amplification ratios run six to nine orders of magnitude. The fix usually defers materialization until the actual data arrives, or replaces the eager constructor with a lazy container, without changing the wire format's promise that the size field has authority.

A security patch closes a CVE by changing a default value rather than removing the unsafe code path. The dangerous behavior is preserved behind a flag the caller controls through the same untrusted request surface the bug was triggered through. The patched binary contains the unpatched primitive; only the value at which the primitive activates has moved. The audit-readable scope of the fix is one number; the runtime behavior depends on whether the caller supplies the toggle.

A parser checks the outer length field that frames its iteration, then trusts each inner length field to drive writes without checking it against the same frame.

Request-scoped middleware (auth, rate limit, RBAC) is wrapped around a handler that upgrades a single request into a long-lived connection. The middleware authenticates the handshake, then never sees the streams that follow.

JavaScript code uses a plain object literal `{}` as a string-keyed dictionary against attacker-controlled keys. Plain objects inherit twelve keys from `Object.prototype`; every one of them resolves to a non-undefined inherited value through bracket lookup. Names like `__proto__`, `hasOwnProperty`, and `toString` reach those values without writing anything to the prototype. The default container leaks the prototype chain. `Object.create(null)` and `Map` do not.

A security fix lands in a project's mainline branch as a public commit, often with a commit message that names the bug class. The next release tag is cut weeks, months, or longer afterward. The git log carries the de-facto disclosure during the gap; package managers that resolve to release tags continue to install the unfixed code. The CVE catches up to the release, not to the fix. The gap between fix-commit date and CVE-publication date is the window in which the bug was public for anyone reading source and unmitigated for everyone running binaries.

The window between credential compromise and detection. Every action in that window is legitimate.

A security check that scans the source text of code for forbidden tokens before handing the code to a dynamic interpreter. The interpreter resolves names, computes strings, traverses method dispatch, and rewrites bytecode at runtime, so any token the check forbids can be reconstructed from pieces the check never matched. The blocklist becomes documentation of the author's threat model rather than enforcement of it.

A file upload handler validates the source filename's extension and writes the file under a destination basename the caller supplied separately. Validating one filename does not validate the other.

Authorization is granted for a request-handle whose contents the attacker can replace before the grant is consumed. Polkit, OAuth, transaction caches, any framework where auth is requested for a slot and the slot's value is mutable post-request.

A library exposes a subclass, callback, or hook framed in the documentation as the seam where the consumer adds security validation, while keeping the unsafe sinks inside the library and never enumerating the inputs the consumer must sanitize. The extension is positioned as the fix; using it does not close the gap.

A server validates signed inbound messages against its own URL and derives that URL from client-supplied request headers. The signed 'intended for X' check becomes 'intended for whatever the client claims X is.'

A periodic process that emits identical success telemetry for "I checked and there was nothing to do" and "I checked and could not determine what to do." Observers cannot tell health from breakage; risk accumulates silently.

A fetcher's allowlist validates the URL it loads a manifest from, not the targets the manifest declares. The fetched payload names the next destination, and the trust placed on the manifest's source does not transfer to the URLs the manifest writes.

Managed file transfer products carry the payload and the trust. Now carry the breaches.

Git tags, date-labeled artifacts, the latest tag. Treated as pinned. Not.

A function asserts a security-relevant verification through its name (verify, verified, validate, check), its return-type struct, and its error messages. The function's body performs only structural gates around the operation the name refers to. The cryptographic, authorization, or integrity step the function claims to run has no corresponding call. Downstream callers treat the function's `:ok` return as proof the named check was performed.

A vendor advisory deliberately withholds the gadget chain, exploit details, or other operational specifics of a security bug. The same vendor's patch commit, public on the project's open-source repository at the same release window, ships a regression test that exercises the chain end-to-end. Regression tests for the patched primitive are by construction the smallest input that reproduces it; for deserialization, command injection, or auth-bypass bugs that input IS the working exploit. The advisory's withholding is a documentation choice that depends on a defender reading only the advisory. The patch's test class is the same project, on the same day, naming what the advisory refused to publish.

Worm pattern in a package registry: infected package harvests credentials, publishes to the next.

A binary compiled without the standard exploit mitigations (PIE, stack canary, FORTIFY_SOURCE, full RELRO). Every memory-safety bug becomes RCE because the build, not the source, decides exploitability.

An interpreter sandbox enforces a method allowlist by class and method name. One allow-listed method's return value carries data from a higher trust tier than the allowlist's grain can see. The allowlist filtered at the method level; the security boundary lives at the data level.

Code passes attacker-controlled values to a subprocess by constructing the call as an explicit argv list rather than as a shell string, reading the choice of list form over `shell=True` as the threat model's full defense. The shell does not run; the receiver binary's own option-versus-positional parser does. List elements that begin with `-` present to the receiver as options regardless of what the calling code intended. The fix is the receiver's documented end-of-options separator (typically `--`) inserted before any attacker-controlled positional slot, or a value-shape predicate that rejects option-shaped inputs. The list form forecloses shell injection. It does not foreclose argument injection.

A subsystem performs fixed-size scratch writes into a destination buffer under an internal contract that it owns the memory. Another subsystem supplies that buffer with foreign-owned pages (page cache, mapped device, peer process). The contract is documentation; the legitimate scratch becomes a write primitive across a trust boundary nobody guards.

A signature verifier transforms an artifact through a parser, normalizer, or re-encoder before handing the result to the cryptographic check. The signature ends up attesting to the verifier's transformed form, not to the raw bytes downstream consumers act on. When the verifier's parser and a downstream consumer's parser disagree about what the raw bytes mean, the verifier's 'verified' label covers bytes nobody else sees.

A protocol specifies different permissions for two endpoints sharing a wire format. The implementation writes one parser and calls it from both sides. The shared parser implements the union of the two roles' grammars; the endpoint whose role the spec narrows inherits the looser endpoint's permissions and admits inputs the spec did not authorize from that direction. The fix is the qualifier on the function name and the call-site update that pins each side to its own grammar.

An API treats an empty filter argument as 'no filter applied' and returns the full set rather than the empty set or an error. A consumer that funnels attacker-controlled input into the filter without rejecting empty values converts an exact-match query into a wildcard scan.

An authentication helper is called at the entry of a handler and its return value bound to a local variable. The variable is used only as a label inside a log line; no if-statement branches on it. Sibling handlers in the same dispatch table call the same helper and branch on the result. The CVE names the handler where the call exists and the branch does not.

A privileged process writes to a directory it never pre-created with restrictive permissions. A standard user occupies the path first as an NTFS junction. The privileged write follows the attacker's redirection.

Two consumers read the same input buffer with different string-length conventions. A security gate uses C-string semantics and stops at the first NULL byte, validating only the prefix; a downstream sink uses length-prefixed byte-buffer semantics and consumes the NULL and everything after it. The bytes are identical. The length the two readers infer is not. The buffer the gate approved is not the buffer the sink acted on.

The attack does not steal. It makes the defender permanently blind to a class of events.

A trust check that reads shared prototype state. Attacker writes once, every object reports trusted.

A network protocol receiver carries decode logic for an optional feature that no sender in the project's own code ever produces. The codepath is unreachable from the application's own clients and therefore unexercised by its tests, fuzzers, and reviews. It is fully reachable, and exclusively exercised, by attacker traffic that sets the trigger field on the wire. Speculative receiver features added "in case we want it later" become attack surface when "later" means never.

A symmetric crypto helper is called by two endpoints in the same application with the same key argument. One endpoint encrypts caller-supplied plaintext and returns the ciphertext as part of its normal response. The other endpoint verifies authorization by decrypting an inbound ciphertext under the same key. The encrypting endpoint becomes a free signing oracle for the verifying endpoint; possession of any output from the first reduces to authorization on the second. The helper's safe default would have salted the key with per-session entropy that isolates the two contexts; both call sites override the default to pass a bare server-wide secret.

Coverage reported as a fraction when only the numerator was ever the story. MFA %, EDR coverage, etc.

An existing CVE and an existing working PoC are republished by a separate author with mathematical-sounding pseudoscience added to the loop structure (Riemann zeros, "temporal" modifiers, exotic decay constants), claiming a severity upgrade the underlying bug cannot support. The added math is decorative. In many cases the headlining script does not reach the original exploit primitive because the author replaced the working network call with a print statement.

A 'race condition' that's actually deterministic. Attacker controls timing because the other side hasn't run yet.

A dispatcher reads from a preference chain of aliased input carriers (e.g., `json` then `msg` then a raw envelope). A sanitizing gate covers one alias and not the others. The dispatcher's first-preferred carrier is the bypass, and the gate's own scope, named after the field the original PoC happened to use, is the admission.

A controller's default-deny authentication posture is opt-out by registration: an array, decorator, or route attribute marks individual actions as callable without a session. The developer uses the opt-out and writes no compensating check inside the handler body. The registration IS the authorization decision; no caller identity is consulted at any layer. The CVE names the action that was registered without a compensating check.

A server with an authenticated peer identity on the transport layer (TLS client cert, mTLS, SPNEGO, SIC) reads a second identity string out of an application-layer request field and uses it as the effective identity. The code falls back to the authenticated source only when the asserted field is absent. The null check is on the caller's assertion, not on whether the two identities agree. The identity the server authorizes against is the one the attacker chose.

A package distributes both a library and a CLI entrypoint that consumes it. A security check that closes a CVE is added at the CLI's startup path; the library's exported class continues to accept the unsafe default. Library consumers that instantiate the class directly bypass the guard. The published advisory and CHANGELOG describe the bug as fixed; the package's library surface still ships the unfixed primitive.

A memory or data disclosure primitive whose exfiltration path passes through a destructive transform (quantization, compression, hashing, sampling). The primitive accesses the bytes; the channel sets the ceiling on what the attacker recovers, often well below the rated severity.

A safety check in a parser is removed in a commit whose justification is that the check is not required by a referenced standard. The standard governs interoperability between cooperating systems; the parser's role is to accept attacker-controlled input. The standard's silence about the check is read as authority to remove it. The commit's CHANGELOG entry files the removal under "Fixed" because compliance is the framing.

A privileged-action handler whose security model depends on an out-of-band confirmation step (email invite, SMS code, two-step approval) branches at runtime on whether the confirmation channel is configured. When the operator has configured the channel, the handler routes through the confirmation; when the operator has not, the handler short-circuits to direct mutation with the credential returned in the HTTP response. The caller's role and the route's middleware do not change between the branches. The route authorizes what the handler is. The runtime branch decides what the handler does.

An HTTP endpoint reads a client-set field (cookie, header, body) and treats a well-known value as proof of a privileged identity. The field is not bound to a server-issued session, not derived from a secret, and not signed. The vendor's own UI writes the same value into every legitimate caller's browser after a login flow whose only effect is to set the value; sending the value directly produces the same effect without presenting the password. The credential is a public constant shipped identically across every deployment.

A CVE-numbered GitHub repository whose contents are educational coursework (a class presentation, lab report, or writeup) described in prose and built with presentation frameworks rather than implemented as runnable code. The students chose the CVE as their assignment topic; the repository name carries the CVE identifier because the project's subject does. A scanner that indexes GitHub by CVE-numbered repository name registers the coursework as a published PoC; the artifact never claimed to be one.

A GitHub repository named for a CVE identifier delivers social-engineering malware instead of a proof-of-concept. The repository ranks against the identifier an administrator is searching for while they patch; the artifact inside is a ClickFix landing page, a reCAPTCHA imposter, or a clipboard-paste PowerShell lure. Because the directory holding the lure is named for the CVE, a scanner that polls GitHub for CVE-tagged repositories counts the lure as a PoC and raises the vulnerability's weaponization score.</short_description> <parameter name="rank">0

A vulnerability disclosed against the maintained downstream of an unmaintained upstream. The fork's maintainers patch and file the CVE under the fork's coordinates; the upstream ships the same code, has no maintainer to triage the report, and remains unflagged in vulnerability databases. The CVE record's affected-products field reflects who responded, not where the bug runs.

A compile-time feature flag named with a debug convention (`_DEBUG_*`, `_IOCTL_DEBUG_*`, `_DBG_*`) gates a security-relevant capability and is unconditionally `#define`d in production headers. No `#ifdef DEBUG` or build-system mechanism enforces the convention. The vendor's release discipline is to comment the macro out before shipping; the discipline is applied to adjacent macros and not to this one. The "debug only" contract has two manifestations in the codebase, the macro's name and an inline comment admitting what it does. The runtime sees neither.

A cryptographic key-derivation routine returns a deterministic, publicly-computable value when its input is the empty string: PKCS#7 of zero bytes is the padding count repeated, HKDF with empty IKM collapses to a function of the salt, constant-key constructions substitute an empty parameter for a hardcoded default. The caller trusts whatever bytes emerge without checking that the derivation had an actual key to work from. The attacker's work is to find the code path that feeds the derivation an empty string.

A multi-part or container-format parser handles a second occurrence of a stream-defining chunk by re-initializing its per-stream state in place. The re-init releases the first occurrence's allocations as a side effect; an outer wrapper that owns the lifecycle retains pointers to those allocations and reaches them at teardown.

A security primitive (escape, quote, prepare, encode) is applied to user input, then its inverse transform is called on the output in the same expression because the primitive's output shape does not fit the consumer's expectations. For benign input the two transforms cancel and the workaround appears to work; for any input containing a character the primitive escapes, the second call removes the escape before the dangerous interpreter sees it. The fix is in the code; the unfix is wrapped around it.

A server-side safety primitive (autoescape pragma, default-encoded template engine, framework HTML helper) correctly covers one rendering pipeline at one trust boundary. The same file or response emits a second rendering pipeline at a different trust boundary, typically client-side template-literal interpolation into innerHTML, on data that arrives by a separate channel. The primitive does not see the second pipeline because the primitive's interpreter does not run there. The developer reads the pragma as "this file is escaped" and is right about the engine the pragma names.

A security remediation is landed through a commit whose message describes the change as linter conformance, refactor, or style cleanup. The code change closes the vulnerability; the audit-readable framing describes it as hygiene. Downstream consumers who follow the project through commit titles, PR bodies, and release notes see no security-urgent signal. The remediation is in the repository; the fact that it is a remediation lives outside the repository, in the CVE record and the researcher's advisory.

A patch implements a security control whose enforcement requires the same observation the bug exposes. Closing the channel would prevent the control from working, so the channel stays open by design and the mitigation rate-limits or post-processes readings of it.

A cryptographic helper takes a key parameter, substitutes a hardcoded constant for it in the operation the function claims to perform, then concatenates the real key onto the result as raw bytes before encoding. Two errors in opposite directions compose: the key is not in the operation, and the key is in the output. Returning the value to any caller publishes the key.

A bounded counter is checked against its ceiling with an equality test against a single target value (`count == max - K`) rather than an inequality against the limit (`count >= max`). The check fires at exactly one value of the counter and at exactly one value of the target. Any deviation in the target's computation that drives it out of the counter's reachable range disables enforcement entirely; any path that steps the counter past the target without firing the check, missing decrements, concurrent increments, signed underflow on `max - 1` when `max = 0`, bypasses the check for the rest of the lifetime of the object holding the counter. The fix is the inequality the equality was substituting for.

A tokenizing loop terminates on a variant it expects to strictly decrease each iteration, and recovers from malformed elements by "skip the bad element and continue." That recovery is correct only if the element parser consumed the bad element's bytes before reporting failure. One input class makes the parser fail having consumed nothing, so the recovery re-presents the same bytes, the variant never moves, and the loop spins forever.

A multi-tenant authorization check encoded as Python equality between two fields that can both legitimately be the unset sentinel (None, null, empty string). When both sides are unset, the equality returns true and the check waves the caller through. The sentinel that means "no tenant" becomes the membership of a shared default tenant, usually the largest population on the system. The fix is never raw equality, the comparison must explicitly assert that the value is non-null before allowing a match.

A permission helper returns the same sentinel value for "caller is administrator" and "caller is unauthenticated". The function carries the sentinel's two meanings in inline comments rather than in the type system. Every downstream consumer reads the sentinel as "allow" because that is what the admin case meant. The unauthenticated visitor inherits admin trust by sharing the sentinel.

A flow whose security depends on the secret traveling only over a trusted side channel (email, SMS, push) is implemented by a service function that hands the same mutable object to the side-channel sender and to the in-band HTTP response. The "out of band only" promise collapses into "out of band, also in band."

A security check lives in an abstract base class as a wrapper around a protected primitive the subclasses implement. A later refactor flattens the hierarchy, deletes the wrapper, and promotes the protected primitive to the public method. The check is not relocated; it is deleted with the wrapper. The subclasses that did not need the check stay coincidentally safe. The subclass that did need it ships as the unsafe primitive's public entrypoint.

A handler pins a server-derived authoritative field (the authenticated user, the tenant ID, the resource owner) at the head of an object literal, then spreads attacker-controlled JSON over the same object. JavaScript's object-literal semantics resolve colliding keys by source order; the spread always wins. The pin reads to code review as enforcement and ships as a default.

A credential parameter required by a user-creation or constructor function is given a literal placeholder value because the developer's threat model places the actual access path on a separate mechanism (unlock key, signed token, admin-only UI). The framework persists the placeholder into the same auth store as real credentials, and a globally network-reachable password endpoint accepts it from any caller. The developer's intent that the placeholder is internal is documentation, not enforcement.

A kernel object pool returns entries to a freelist without erasing them. Each caller's writes past the next caller's expected watermark persist into entries handed to subsequent unrelated callers. The cross-caller contract is that nobody reads past their own writes; the kernel does not enforce it. Combined with any bounded out-of-bounds write into a pool entry, the residue from an attacker's earlier exec becomes a persistent attacker-controlled staging area in another process's view of the pool.

A cache or dedup key derived from a fixed-length prefix of a value, on an implicit assumption that the prefix carries per-actor entropy. When the producer's encoding concentrates entropy past the prefix window (a JWT payload past the header, a URL path past the host, a salted hash past the salt), every actor's value maps to one bucket. The type signature is `str`; the entropy contract is documentation. When the producer's shape drifts, the slice goes from fingerprint to constant without warning.

A throttle, rate-limit, or budget counter increments at request entry, before the authentication check that determines whose budget is being spent. When the bucket is keyed by route, target, or shared identity rather than by per-caller credential, unauthenticated callers debit the authenticated bucket. The 401 rejects the request; it does not refund the counter.

An auth or authz check that fails the caller, then writes the expected value into the response body before terminating. The reject branch performs the comparison, computes the value the caller should have sent, and emits it. Often originates as a debug print added during initial development to verify the comparison works; ships because the reject branch is the path no developer re-reads.

An SSH or TLS implementation advances its authenticated-session state after processing a client-requested rekey, treating a transport-layer key refresh as the gate the application-layer authentication phase was supposed to pass.

The CVE's affected-versions line is the vendor's end-of-support matrix, not a code boundary. The bug class and the fix exist across the branches both inside and outside that matrix; the record encodes the vendor's business decision as if it were a property of the code.

A hierarchical name-resolution algorithm (executable PATH, dynamic-linker library search, language-runtime module resolver) walks up a directory tree generating candidate paths at each level and terminates at a system-defined root. The algorithm was authored against a platform whose terminal node is administrator-owned and treats that ownership as the implicit allowlist on the lookup-path list. The deployment platform places the terminal node inside a user-writable trust zone. First-match-wins resolution accepts the standard user's planted artifact over the legitimate one further down the walk.

A non-cryptographic PRNG is used both to generate long-lived secrets (signing keys, bootstrap identifiers, session tokens) and to produce values the server returns to unauthenticated callers. The two uses share generator state. Observing enough of the public outputs reconstructs the state and derives the secrets. The entropy of the secret is bounded by the entropy an attacker cannot observe through the public path; for a process-global PRNG, that bound is zero.

A check intended to detect arithmetic overflow is written as a comparison against zero (`if (result < 0) throw`). The check fires when the multiplication or addition tips the value into negative territory and is silent when the high bits leave the integer cleanly and the result stays positive. The author's commit message names the threat correctly; the implementation captures one of overflow's two visible signatures and reads to code review as a comprehensive guard.

A document arrives with a cryptographic signature over an inner artifact, but the verifier extracts signatures at a pipeline stage where the inner artifact is still wrapped (encrypted, encoded, deferred-parsed). After a later stage opens the wrapper, the verifier never re-extracts. The signature exists in the document and is never in the validator's working set; the outer envelope's signature is treated as having authenticated content it never covered.

Hardware wallet / HSM / signer shows one thing, signs another. Trust boundary lives at the rendering layer.

A new ecosystem replaying every lesson the old ones learned. Same registry shape, same provenance gap.

A security-relevant configuration is validated once at process startup and never re-checked, even though the same process supports hot-reload, dynamic registration, or runtime mutation of that same configuration. The startup pass creates an assurance the runtime path does not maintain. The rail ran. The state changed. The runtime never reconciles.

A defensive input validator whose worst-case complexity is unbounded with respect to attacker-controlled input, called synchronously on the hot path. The acceptance branch is cheap; the rejection branch requires the matcher to exhaust every possible match attempt before reporting failure. An attacker who can force rejection forces the cost. The validator's defensive purpose and the validator's denial-of-service primitive are the same artifact; the fix usually repairs the matcher's worst case without changing the accepted language.