惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

人人都是产品经理
人人都是产品经理
freeCodeCamp Programming Tutorials: Python, JavaScript, Git & More
宝玉的分享
宝玉的分享
月光博客
月光博客
爱范儿
爱范儿
让小产品的独立变现更简单 - ezindie.com
让小产品的独立变现更简单 - ezindie.com
WordPress大学
WordPress大学
有赞技术团队
有赞技术团队
阮一峰的网络日志
阮一峰的网络日志
博客园_首页
钛媒体:引领未来商业与生活新知
钛媒体:引领未来商业与生活新知
博客园 - 三生石上(FineUI控件)
博客园 - 聂微东
小众软件
小众软件
量子位
MongoDB | Blog
MongoDB | Blog
Blog — PlanetScale
Blog — PlanetScale
The Cloudflare Blog
Stack Overflow Blog
Stack Overflow Blog
U
Unit 42
Hugging Face - Blog
Hugging Face - Blog
T
The Blog of Author Tim Ferriss
H
Help Net Security
Cyber Security Advisories - MS-ISAC
Cyber Security Advisories - MS-ISAC

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant
⚖️ Case File 3.1: The Rubber Stamp Fraud
Manoj Mishra · 2026-05-19 · via DEV Community
Cover image for ⚖️ Case File 3.1: The Rubber Stamp Fraud

Manoj Mishra

The Collaboration Cartel

The most common form of technical fraud in software engineering isn’t writing buggy code; it’s signing off on logic you haven't actually read.

After leading engineering teams for years, I can tell you that the quickest way to destroy a team’s trust is to treat the Pull Request (PR) process as a mere formality. We have all seen it: a major logic change with zero review comments, approved in five minutes. This isn’t "supportive" teamwork; it is the Rubber Stamp Fraud, and it is professional negligence.


🛑 The Crime: The Ghost Review

Checking for syntax is a job for linting tools; checking for logic is a job for engineers.

  • The Scenario: A large PR arrives on Friday afternoon, containing critical updates to a billing service. The reviewer, desperate to get home, scans the diff, sees that the tests passed, and clicks "Approve."
  • The Crime: Signing off on the change without thoroughly reviewing the business logic or the "thinking mistakes".
  • The Brutality: The logic has a critical flaw: it accidentally processes payments on inactive accounts, leading to thousands of dollars in financial discrepancies. When asked why they approved it, the reviewer says, "It passed linting." They can't explain the logic because they never actually read it.
  • How to Avoid It: If you don't have time to review the logic properly, do not approve it. Request a delay or ask for a partial review.
  • Brutal Habit to Adopt: The Hostile Code Witness. Review every PR as if the author is a hostile witness trying to sneak a bug past you. Every line of code is guilty of being suboptimal until proven otherwise.

"Verification, Not Vanity."


🧱 The Crime: The "Supportive" Accomplice

Approving your friend's flawed PR isn't teamwork; it’s a career conspiracy.

  • The Scenario: Your colleague and friend is struggling to hit a sprint goal. They have built a microservice but broke the downstream services. They need your "LGTM" (Looks Good To Me) to get the code merged and satisfy the project manager.
  • The Crime: Prioritizing team harmony or friendship over the technical integrity of the system.
  • The Brutality: The change causes production failures, breaking the three services downstream. Your team is now the source of technical debt for other teams.
  • How to Avoid It: Separate the person from the product. Critique the code, not the engineer. Technical authority is built on consistent standards, not transactional favors.
  • Brutal Habit to Adopt: The Blast Radius Audit. Before every approval, you must explicitly ask the author: "What is the blast radius of this change? Have you verified the downstream impact?"

"Ship Integrity, Not Favors."


🤖 The Crime: Automated Absolution (AI Collaboration)

Believing an AI's PR summary over the actual code is technical archaeology on a ticking bomb.

  • The Scenario: You use an AI agent to generate the description for a complex Pull Request. The AI provides a confident, clean explanation of what the change does.
  • The Crime: As the reviewer, reading only the AI-generated context summary and accepting it as absolute truth without cross-referencing the actual source code.
  • The Brutality: The AI hallucinated a crucial part of the summary. The code itself fails the 30-Minute Test: it is so "clever" and complex that a new hire cannot grasp the core logic in half an hour. By ignoring the code, you merged a maintainability nightmare.
  • How to Avoid It: AI is great for creating summaries, but the code is the only true source of logic. Always use the code, not the explanation, as your final authority.
  • Brutal Habit to Adopt: The Code-First Mandate. Never read the PR description until you have scanned the diff. Form your own mental model first, then use the description only to see if the author's intent matches their implementation.

"Source Code is Law."


🛠️ Case File Takeaway: The 30-Minute Readability Test

If a new hire cannot look at your architecture or code and understand the core logic within 30 minutes, you have committed a crime against readability.

💡 Professional Tip: When starting a task, step away from the IDE. Design the project (or major code section) on paper first. List the core requirements, draw the data flow, and identify the "hard parts." If your paper design requires a manual and a translator, it’s not "advanced"—it’s already broken.


📋 Cheat Sheet: The Collaboration Cartel

[The Rubber Stamp Fraud]
The Crime The Red Flag The Fix Mnemonic Brutal Habit to Adopt
Ghost Review Approved, zero logic feedback. Review logic, not just syntax. Verification, Not Vanity Hostile Code Witness
"Supportive" Accomplice "LGTM" as a friend's favor. Ship integrity, separate people. Ship Integrity, Not Favors Blast Radius Audit
Automated Absolution Read AI summary, ignore diff. The diff is the only truth. Source Code is Law Code-First Mandate

Next Part: We move to Case Fle 3.2: The Silo Conspiracy, where we tackle the crimes of downstream breakage and holding codebases hostage.

What is the worst case of "Rubber Stamp" negligence you've witnessed in production?

💬 Let's talk in the comments.