The pull request was forty files.
You opened it
with your coffee
and a clear head.
Ten minutes in
you found it.
An off by one
in the paging loop.
A real bug.
You left a good comment,
explained it,
suggested the fix.
Then you skimmed the rest,
approved it
on condition the loop was fixed,
and moved on.
A week later
an incident review
traced a data leak
to a missing permission check
in the same pull request,
two files after the loop.
You had scrolled straight past it.
You were not tired.
You were done.
Radiologists know this one.
They call it
satisfaction of search.
A doctor reading a chest X-ray
finds a clear abnormality,
a fracture,
a shadow on the lung,
and becomes more likely
to miss a second one
on the same image.
The name goes back to the 1960s.
Since around 1990
studies have tested it directly,
adding a simulated nodule
to real images
and measuring what else
readers stopped seeing.
Research on airport baggage screening
found the same pattern
and calls it
subsequent search misses.
The first finding
feels like the answer.
The search had a question,
is anything wrong here,
and once it is answered
the mind stops asking.
But a pull request
is not a question with one answer.
Bugs travel together.
The same hurry
that wrote the off by one
skipped the permission check.
So change what finding something means.
When you find the first problem,
write it down
and carry on from where you were,
as if you had found nothing.
Keep a short list
of the things you always check,
permissions,
inputs,
errors,
and go through it
after the first comment,
not instead of it.
Big diffs make this worse,
so ask for smaller ones.
And when you approve,
say what you looked at.
I checked the loop
is a different sentence
from I checked the change.
Finding one bug
is not evidence
there is only one.
It is evidence
there was a hurry.
– Serguey Asael Shinder
Top comments (0)