We launched local pricing in JPY, KRW and VND and a customer in Osaka was charged 398,000 yen for a 3,980 yen course. Our code multiplied every price by 100 before sending it to Stripe. How we found it, refunded it and built a per-currency exponent table with tests.
A customer changed the number in an invoice download URL and got someone else's PDF. The endpoint looked up invoices by sequential ID with no ownership check. We scoped every query to the account, added an object policy and cross-tenant tests.
Our comment system rendered Markdown and stripped script tags, yet a link with a javascript: URL survived into the page. We fixed it by sanitizing the rendered HTML with an allowlist of tags, attributes and URL schemes, and backed it with a strict Content-Security-Policy.
Every POST to our Django admin returned 403 after we moved TLS termination to a Traefik ingress. Django compared the browser's https Origin with a request it believed was plain http. Two settings fixed it without weakening CSRF.
A one-line ALTER TABLE in a deploy hung for eleven minutes and took the whole site down with it. An idle-in-transaction worker held a lock, the ALTER queued behind it, and every query queued behind the ALTER. Here is the diagnosis and the timeouts we now set.
Debugging is faster as a method than as inspiration. The six steps we use on every hard bug, from a reliable reproduction to a regression test, walked through on a real slowdown we isolated among 143 commits with an automated git bisect run.