Ground Truth

A finding from reading code is a hypothesis with a severity attached to it. The running system is the only thing that can tell you whether it is a risk, an outage, or nothing at all. That difference routinely spans three severity levels, in both directions.

The point of this skill is not "test in production". It is that a class of defect is undetectable from the repository, because the repository is an input to the deployed state and not a copy of it.

The three questions

For any finding, answer these before assigning a severity or writing a fix:

1. Is it happening? Not "could it happen". Find the effect in the data, or find the absence of the effect that should be there.
2. Since when? A date turns "risk" into "outage", and it tells you the size of the backlog you are about to create by fixing it.
3. How far does it reach? Which rows, which users, which money, which downstream jobs.