惯性聚合 高效追踪和阅读你感兴趣的博客、新闻、科技资讯
阅读原文 在惯性聚合中打开

推荐订阅源

Martin Fowler
Martin Fowler
CTFtime.org: upcoming CTF events
CTFtime.org: upcoming CTF events
A
About on SuperTechFans
Apple Machine Learning Research
Apple Machine Learning Research
The Register - Security
The Register - Security
Vercel News
Vercel News
H
Hackread – Cybersecurity News, Data Breaches, AI and More
人人都是产品经理
人人都是产品经理
MyScale Blog
MyScale Blog
云风的 BLOG
云风的 BLOG
博客园_首页
U
Unit 42
T
Tailwind CSS Blog
G
GRAHAM CLULEY
F
Full Disclosure
V
Vulnerabilities – Threatpost
T
Tenable Blog
月光博客
月光博客
P
Privacy & Cybersecurity Law Blog
P
Privacy International News Feed
K
Kaspersky official blog
Scott Helme
Scott Helme
cs.AI updates on arXiv.org
cs.AI updates on arXiv.org
N
News and Events Feed by Topic
T
The Exploit Database - CXSecurity.com
N
News and Events Feed by Topic
有赞技术团队
有赞技术团队
Recent Commits to openclaw:main
Recent Commits to openclaw:main
L
LINUX DO - 最新话题
Recorded Future
Recorded Future
Application and Cybersecurity Blog
Application and Cybersecurity Blog
Help Net Security
Help Net Security
The GitHub Blog
The GitHub Blog
Cisco Talos Blog
Cisco Talos Blog
SecWiki News
SecWiki News
P
Proofpoint News Feed
Security Latest
Security Latest
cs.CL updates on arXiv.org
cs.CL updates on arXiv.org
罗磊的独立博客
S
Security Affairs
M
MIT News - Artificial intelligence
L
LINUX DO - 热门话题
美团技术团队
Simon Willison's Weblog
Simon Willison's Weblog
T
Threat Research - Cisco Blogs
Stack Overflow Blog
Stack Overflow Blog
Forbes - Security
Forbes - Security
Hugging Face - Blog
Hugging Face - Blog
博客园 - Franky
V
Visual Studio Blog

DEV Community

Authentication Security Deep Dive: From Brute Force to Salted Hashing (With Java Examples) Why AI Systems Don’t Fail — They Drift Spilling beans for how i learn for exam😁"Reinforcement Learning Cheat Sheet" I Replaced Chrome with Safari for AI Browser Automation. Here's What Broke (and What Finally Worked) How Python Borrows Other People's Work The $40 Architecture: Processing 1 Billion API Requests with 99.99% Uptime Vibe Coding: A Workflow Guide (From Zero to SaaS) Most webhook security guides protect the wrong side. The scary part is delivery. Headless CMS for TanStack Start: Build a Blog with Cosmic EU Age Verification App "Hacked in 2 Minutes" — What Actually Happened Comfy Cloud’s delete function does not actually remove files Running AI Models on GPU Cloud Servers: A Beginner Guide Event-driven media intelligence with AWS Step Functions and Bedrock I scored 500 AI prompts across 8 quality dimensions — here's what broke How to Call Google Gemini API from Next.js (Free Tier, No Backend Needed) The Portal Protocol: Reclaiming Human Connection in the Age of AI How to Fix Your Team's Scattered Knowledge Problem With a Self-Hosted Forum Intro to tc Cloud Functors: A Graph-First Mental Model for the Modern Cloud Designing Multi-Tenant Backends With Both Ownership and Team Access I Built a Neumorphic CSS Library with 77+ Components — Here's What I Learned PostgreSQL Performance Optimization: Why Connection Pooling Is Critical at Scale Cómo construí un SaaS multi-rubro para gestionar expensas en Argentina con FastAPI + Vue 3 🚀 I Built an Ethical Hacking Scanner Tool – Open Source Project I Replaced /usage and /context in Claude Code With a Single Statusline A Pythonic Way to Handle Emails (IMAP/SMTP) with Auto-Discovery and AI-Ready Design I Collected 8.9 Million Polymarket Price Points — Here's What I Found About How Markets Really Move EcoTrack AI — Carbon Footprint Tracker & Dashboard Everyone's Using AI. No One Agrees How. 5 self-hosted ebook managers worth trying in 2026 Building Your First AI Agent with LangChain: From Chatbot to Autonomous Assistant Common SOC 2 Failures (Real World) Stop Vibe-Checking Your AI App: A Practical Guide to Evals How to Use SonarQube and SonarScanner Locally to Level Up Your Code Quality Your Next To-Do App Is Dead — I Replaced Mine with an OpenClaw AI Sign a Nostr event in 60 lines of Python using coincurve — no nostr-sdk, no nbxplorer, no rust toolchain ITGC Audit Explained Like You’re in Big 4 Patch Tuesday abril 2026: Microsoft parcha 163 vulnerabilidades y un zero-day en SharePoint Stop scraping everything: a better way to track competitor price changes Listing on MCPize + the Official MCP Registry while routing payments OUTSIDE the marketplace — how I kept 100% of my x402 revenue Building an AI-Powered Risk Intelligence System Using Serverless Architecture Why We Ripped Function Overloading Out of Our AI Toolchain Testing AI-Generated Code: How to Actually Know If It Works SaaS Churn Is Killing Your Business. Here Is What to Do About It (Without a Support Team) The Speed of AI Is No Longer Linear - And Self-Improving Models Are Why How to Implement RBAC for MCP Tools: A Practical Guide for Engineering Teams From Standard Quote to Persuasive Proposal: AI Automation for Arborists I built a CLI that scaffolds complete multi-tenant SaaS apps Axios CVE-2025–62718: The Silent SSRF Bug That Could Be Hiding in Your Node.js App Right Now The dashboard that ended our friendship Data Pipelines Explained Simply (and How to Build Them with Python) The Hidden Cost of AI Systems Nobody Talks About. undefined vs undeclared, and how typeof behaves Switching from file-based jobs to NATS/Kafka in Rust without changing code io_uring Adventures: Rust Servers That Love Syscalls Why Agentic AI is Killing the Traditional Database The POUR principles of web accessibility for developers and designers Quantum Neural Network 3D — A Deep Dive into Interactive WebGL Visualization How To Install Caveman In Codex On macOS And Windows Automation Pipeline Reliability: Why Your Workflow Breaks When Nobody Is Watching I Built an 'Open World' AI Coding Agent — It Works From ANY Folder From Freelancing to Product: A Tech Service Company's SaaS Transformation China's AI Giants: Adding Tencent Hunyuan & ByteDance Doubao to AI University (74 Providers) On the Vibe Coders and Their Lies clerk: Auto-Summarize Your Claude Code Sessions AI Weekly — 2026/04/10–04/17 | The Model Lockdown Is Here, but the Toolchain Is the Real Battleground AI 週報 — 2026/04/10–2026/04/17 模型封鎖潮來了,但工具鏈才是真戰場 Maybe this is how Open-Source apps are born... 🚀 Fine-Tune LLMs with LoRA and QLoRA: 2026 Guide tRPC v11 + Next.js App Router: End-to-End Type Safety Without the Boilerplate ShadCN UI in 2026: Why I Stopped Installing Component Libraries and Started Owning My Components SaaS Billing in React Server Components: Stripe + Supabase Without a Single `useEffect` Join our DEV Weekend Challenge — $1,000 in Prizes Across TEN winners! Submissions Due April 20 at 6:59 AM UTC. Implementing FSRS Spaced Repetition in Flutter + Supabase — Adding Memory Science to an AI Learning App "I Texted My Localhost From the Train — Claude Code Fixed the Bug Before I Got Home" I Built a Sales Prep AI and It Went Deeper Than Expected Design to Code #2: One JSON, Eleven Outputs Solving the 100M-Row Problem: A Summary Table Pattern for High-Volume Push Notification Logs Flutter Web With Wasm: What Actually Changes For Developers I Built 50 Royalty-Free Soundtracks for My Side Project in a Weekend Using AI Music Generation The Vibe Coding Security Checklist: 7 Things to Check Before You Ship Stop Letting Googlebot Guess Fix Your React App's SEO Right Desconstruindo o Streaming do LinkedIn: Como Criar um Engine de Extração de Vídeo de Alta Performance com HLS e FFmpeg (EDA Part-1) EDA (Exploratory Data Analysis) Explained With Real Life — Why Looking at Your Data Is the Most Important Step in Machine Learning Brand Relationship Management at Scale: Our 4-Touch Outreach System for 200+ Brands Why String.fromEnvironment() Might Return an Empty String in Dart JGuardrails 1.0.0 — Hardening Java LLM Apps Against Jailbreaks, Toxicity, and Prompt Injection Plan and Schedule a Full Week of Threads Content From One Claude Conversation Coding Cat Oran Ep3, Five Tables Changed Everything Updated: BFF Pattern I'm done watching freelancers get buried by 200 proposals. So I'm building the alternative. This is my first post BFS Algorithm in Java Step by Step Tutorial with Examples Tracking LLM Pricing Monthly: An Open Dataset for 22 AI Models How We Measure Content ROI on a Comparison Site: Revenue Attribution Without Perfect Data Introducing Nova AI Ops: The AI-Native Operating System for SRE Teams I built a free desktop video downloader for Windows — Grabbit How Talkie OCR Helps Vision-Impaired & Dyslexic Users Read the World Around Them VRCFaceTracking安装和iPhone面捕配置教程,有bug Even CrowdStrike Can't See Your Agents The Automation Gold Rush: What n8n Workflows and Claude Are Opening Up for Developers Right Now
Feature Flags That Forgot to Leave
Ian Johnson · 2026-05-26 · via DEV Community

A feature flag goes into the codebase to make a rollout safer. The new behavior lives behind the flag. The team turns the flag on for one customer, then ten, then everyone. The rollout succeeds.

The flag is still in the code.

It is still in the code six months later. Still in the code a year later. The team that added it has rotated. The flag has been "on" for everyone for so long that nobody remembers the old behavior. The branch behind the false value is unreachable in any environment, and yet the code remains, and every reader has to mentally evaluate both branches every time they encounter the flag.

Feature flag debt is the slowest-moving anti-pattern in most codebases. It does no damage on any given day, and it accumulates anyway. Agents make the accumulation worse.

What flag debt costs

A live feature flag in the code is not free. It is a branch: a real one, in the control flow sense, even if no environment actually traverses both sides.

A reader has to evaluate both branches. A reviewer has to consider whether a change to one branch should also apply to the other. A test suite has to either cover both branches or accept that one of them is untested. A monitoring system that catches errors has to do so for code paths that, in production, might never run.

When the flag was new and the rollout was live, all of this was worth it. After the rollout, none of it is. The cost stays; the value left.

Multiply this by every flag your team has ever shipped and never cleaned up. The codebase becomes a thicket of dormant branches, each one a small cognitive tax, none of them individually large enough to be worth a cleanup PR. The team works around them, slowly, paying the tax in attention rather than in time.

How agents make it worse

Agents reason about both branches of a flag. Asked to refactor a function that contains a flag check, the agent will preserve the structure, update both branches, and present a diff that respects the conditional. The agent is doing the right thing. It does not know that one branch is dead. The cost is that every refactor touching flagged code touches dead code, which adds noise to the diff and time to the review.

More subtly, agents will pattern-match against existing flag usage and produce new flag usage. A codebase with twenty stale flags teaches the agent that wrapping new behavior in a flag is the local idiom. The agent helpfully writes more flags. Each new flag has the same lifecycle problem the existing ones did.

The combination is that flag debt does not just stay; it grows. The codebase that has tolerated flag accumulation produces an agent that produces more flag accumulation.

The lifecycle nobody runs

Every feature flag has, in principle, a lifecycle. It is added. It is rolled out. It is fully enabled. It is cleaned up. The cleanup step is the one teams skip.

The skip is structural, not lazy. The team that added the flag has moved on by the time it is fully rolled out. The cleanup is not anybody's current priority. There is no urgency. The system works whether the flag is cleaned up or not. There is no automated reminder, because most flag systems do not have one. So the cleanup sits in a backlog that grows by one row every time a new flag ships, and shrinks by one row almost never.

The fix is not better intentions. It is making the cleanup a step in the rollout, not a follow-up to it. The flag is not "done" when it is fully enabled; it is done when the code is removed.

Tooling helps

Modern feature flag platforms (LaunchDarkly, Unleash, Statsig, the open-source equivalents) increasingly include staleness detection. They report flags that have been at 100% (or 0%) for some period, flags with no usage, flags that nobody has updated in months. The reports give the team a target list without requiring anybody to remember.

For teams not on a platform, the analog is a script. Walk the codebase, find every reference to a flag-checking function, cross-reference with the flag store. Output a table of flags by age and current value. Run it weekly. Anyone can write this script in an afternoon; the value is in actually looking at the output.

The tooling does not delete the flags. It surfaces the ones that can be deleted. The deletion is still a human or agent decision, and it is still a code change. But it is no longer the question "what flags should we clean up?"; it is the question "should we clean up these specific flags this week?" The second question gets answered. The first does not.

What the cleanup looks like

Removing a flag is a small, well-defined refactor. The agent is good at it, given a clear instruction.

Pick the flag. Determine the value it has been pinned to for the long term: usually true, sometimes false. Replace every reference to the flag's check with that value. Simplify the resulting conditionals: if (true) { ... } becomes the body of the if; if (false) { ... } becomes nothing. Run the tests. The diff is mechanical. Most flags can be removed in a single PR by a single contributor in under an hour.

The work scales. A team that removes one flag per week ends a year with fifty fewer flags. The cumulative effect on readability is meaningful.

First steps

If your codebase has accumulated stale flags:

Inventory them. Pull the list of every flag your team has ever defined. For each, note the current value, when it was last changed, and whether the rollout it was created for has concluded.

Sort by age, descending. The top of the list is your cleanup target. Pick the oldest flag whose rollout is clearly done, one that has been at 100% for longer than anyone remembers, and remove it. One PR. Ship it.

Add a step to your flag-creation process: every new flag has an owner and a target removal date, written into the flag's description in the flag platform. The dates do not have to be precise, but they have to exist. A flag without a removal plan is a flag that will never be removed.

Add a recurring item to your team's weekly or biweekly review: stale flag report. Look at it. Pick one to clean up. Assign it. Move on.

Add a rule to AGENTS.md: "When making changes that touch a feature flag, check whether the flag's rollout has concluded. If yes, propose removal of the flag in the same change. Do not introduce new feature flags without an owner and a target removal date in the flag's description."

Feature flags are useful. The mistake is treating them as permanent fixtures rather than temporary scaffolding. Scaffolding stays up only as long as the construction needs it. After that, it is not scaffolding; it is junk in the yard. The same applies to flags.

The codebase that uses flags well is one that adds them confidently because it trusts itself to remove them when the work is done. Building that trust is a matter of running the cleanup, repeatedly, until it becomes the default rather than the exception.