Identify bugs by their symptoms

Symptoms:

• >Unexpected rows returned or privilege changes after user-controlled input.
• >Database errors mentioning syntax near quotes or UNION/SELECT.
• >Blind timing differences when injecting logical conditions (e.g., sleep/delay).

Example Errors:

Symptoms:

• >Shell errors when user input contains separators like `&&`, `|`, `;`, or backticks.
• >Unexpected files/processes created by requests containing crafted arguments.
• >Behavior differences when input includes wildcard or redirection characters.

Example Errors:

Symptoms:

• >User-controlled content renders as HTML/JS in the page (alert boxes, DOM modifications).
• >Console logs show script execution from untrusted sources.
• >Reports of unexpected redirects or credential theft tokens in requests.

Example Errors:

Symptoms:

• >Server makes outbound HTTP requests to attacker-provided URLs.
• >Access to internal metadata endpoints (e.g., 169.254.169.254) observed in logs.
• >High latency or timeouts when fetching user-supplied URLs.

Example Errors:

Symptoms:

• >Requests containing `../`, `%2e%2e/`, or similar sequences access unexpected files.
• >Logs show attempts to reach `/etc/passwd`, `.env`, or config directories.
• >Mismatches between requested path and served file outside the web root.

Example Errors:

Symptoms:

• >Changing an ID in URL/body returns another user’s resource.
• >Authorization passes for resource A but not enforced for resource B of same type.
• >Audit logs show cross-tenant or cross-user reads/writes.

Example Errors:

Symptoms:

• >Privileged actions available via hidden UI routes or client-side checks only.
• >Sessions not invalidated on logout or credential change.
• >Role/claim tampering grants unauthorized access.

Example Errors:

Symptoms:

• >Secrets/PII appear in logs, URLs, client storage, or error messages.
• >Weak or missing TLS; outdated ciphers; plaintext storage of sensitive data.
• >Database dumps or backups accessible from public endpoints/buckets.

Example Errors:

Symptoms:

• >Hydration warnings or DOM checksum mismatches on initial render.
• >Server-rendered markup differs from client render (blinking or reflow).
• >Stateful values (dates/random IDs) differ between server and client.

Example Errors:

Symptoms:

• >Runtime errors where types claim non-null but values are null/undefined.
• >Compilation passes but runtime fails on property access.
• >API responses omit fields expected as required in client types.

Example Errors:

Symptoms:

• >Client fails parsing responses due to missing/renamed fields.
• >Builds succeed but integration tests fail after API rollout.
• >Contract tests or schema diffs show breaking changes.

Example Errors:

Symptoms:

• >API receives parameter but handler reads a differently named field.
• >Form submits succeed but server ignores the intended value.
• >OpenAPI doc shows field casing that differs from implementation.

Example Errors:

Symptoms:

• >Feature toggles behave opposite to expectation.
• >Guard clauses always allow or always block.
• >Test for negative case passes while positive fails.

Example Errors:

Symptoms:

• >Assignments have no effect outside block scope.
• >Unexpected value read due to inner variable masking outer one.
• >Linters warn about shadowed variables.

Example Errors:

Symptoms:

• >Switch/case fallbacks triggered unexpectedly.
• >Branching behaves differently across platforms/types.
• >Magic numbers used instead of enum symbols.

Example Errors:

Symptoms:

• >Static analysis flags unreachable/dead code.
• >Coverage tools show never-executed blocks.
• >Refactor introduced early returns skipping code.

Example Errors:

Symptoms:

• >First/last element skipped or duplicated.
• >Index out-of-range on boundary inputs.
• >Allocated size differs by exactly one element.

Example Errors:

Symptoms:

• >Negative or wraparound values after arithmetic.
• >Allocation sizes overflow leading to tiny buffers.
• >Counters reset unexpectedly at large values.

Example Errors:

Symptoms:

• >Crashes or corruption after copy/format operations.
• >ASAN/Valgrind reports out-of-bounds writes.
• >Unusual control flow or return address corruption.

Example Errors:

Symptoms:

• >Aggregate invariants violated (e.g., totals not matching line items).
• >Conflicting statuses across related entities.
• >Intermittent bugs after partial updates or reordering of operations.

Example Errors:

Symptoms:

• >Duplicate keys or usernames appear after concurrent inserts.
• >Database raises unique/duplicate key errors.
• >Idempotent operations still create duplicates.

Example Errors:

Symptoms:

• >Some services read new schema while others expect old.
• >Runtime errors referencing missing columns/tables.
• >Data shape differs between environments.

Example Errors:

Symptoms:

• >Non-deterministic failures under load or on CI.
• >Data occasionally overwritten or lost when requests overlap.
• >Flaky tests that pass locally but fail intermittently.

Example Errors:

Symptoms:

• >Check-then-act logic fails when state changes between operations.
• >Validation passes but subsequent use sees different state.
• >Time-of-check/time-of-use windows exploited in tests.

Example Errors:

Symptoms:

• >Unhandled promise rejections in logs/console.
• >Hidden failures where downstream steps silently skip.
• >UI freezes or inconsistent state after async errors.

Example Errors:

Symptoms:

• >Double charges/duplicate records created by retries or resubmits.
• >Idempotent endpoints behave inconsistently across retries.
• >Network errors followed by duplicated side effects.

Example Errors:

Symptoms:

• >Users see old data after update until cache expires.
• >Inconsistent views across nodes/regions.
• >Conditional requests not revalidating as expected.

Example Errors:

Symptoms:

• >Operations fail silently with no logs or metrics.
• >Downstream components receive invalid/partial results.
• >Retry/backoff not triggered on transient failures.

Example Errors:

Symptoms:

• >Process or request crashes without graceful fallback.
• >500 errors with stack traces exposed.
• >Background jobs halt on first error.

Example Errors:

Symptoms:

• >Errors swallowed; system continues in corrupted state.
• >Generic catch blocks mask root causes.
• >Retries applied to non-retriable errors.

Example Errors:

Symptoms:

• >Downstream functions receive unexpected types/shapes.
• >Security scanners flag injection risks on unvalidated inputs.
• >Frequent 400/422 validation failures in logs.

Example Errors:

Symptoms:

• >Parsing failures for locale-dependent date strings.
• >Inconsistent results across time zones/offsets.
• >Sorting/aggregation wrong due to string dates.

Example Errors:

Symptoms:

• >Crashes or exceptions when accessing properties on null/undefined.
• >Intermittent failures depending on optional inputs.
• >Hot path guarded only in some code paths.

Example Errors:

Symptoms:

• >Process memory grows over time without returning to baseline.
• >Frequent GC pauses or OOM kills under steady load.
• >Heap snapshots show unreachable yet retained objects.

Example Errors:

Symptoms:

• >Open file/socket handles increase and never drop.
• >DB connection pool exhaustion during errors/timeouts.
• >OS reports 'too many open files' or descriptor exhaustion.

Example Errors:

Symptoms:

• >Crashes with inconsistent stack traces.
• >ASAN/UBSAN detects out-of-bounds or use-after-free.
• >Nondeterministic behavior sensitive to build flags.

Example Errors:

Symptoms:

• >Immediate crash on deep input recursion.
• >Large local allocations trigger stack overflow.
• >Tail recursion absent where expected.

Example Errors:

Symptoms:

• >Latency spikes and long tasks on main thread/event loop.
• >Throughput drops under CPU-bound sections.
• >User-visible jank during heavy computation.

Example Errors:

Symptoms:

• >Requests hang or CPU spikes on specific input strings.
• >Regex evaluation dominates profiles under load.
• >DoS-like behavior with crafted repeating patterns.

Example Errors:

Symptoms:

• >UI stutters during parsing/validation on input.
• >Server event loop stalls when validating large payloads.
• >Throughput collapses under heavy synchronous checks.

Example Errors: