{
  "id": 1410317,
  "title": "I found code in my repo I'd never seen. All 82 tests passed. I quarantined it for three days anyway.",
  "url": "https://urgent.news/2026/08/17/i-found-code-in-my-repo-id-never-seen-all-82-tests-passed-i",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-17T03:22:43.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/achiya-automation/i-found-code-in-my-repo-id-never-seen-all-82-tests-passed-i-quarantined-it-for-three-days-anyway-33go"
  },
  "original_language": "en",
  "account": "My open-source project was unexpectedly modified 24 hours earlier with a file called extension/background.js. I had no memory of making these changes. I discovered that an AI coding session, working on a different task, had added a feature that fixed a browser automation tool limitation. The change was a real feature and the tests passed. Despite the green tests, I decided to quarantine the code for three days before deciding whether to integrate or revert it. This quarantine was not a precaution, but a safeguard against potential issues, as authorship does not guarantee verification. The quarantine served two purposes: ensuring proper authorship and verifying the code's functionality through tests. On the third day, I reviewed the code thoroughly, discovering a documentation bug that could cause incorrect click positioning in cross-origin iframes. I fixed the comment to clarify the coordinate space and added documentation for callers to offset using the frame field. This allowed the feature to be properly released as v2.16.0. My recommendation is to quarantine any diff you don't remember writing, set a deadline for review, and then decide whether to integrate or revert it, ensuring proper documentation and semantic clarity in the code.",
  "summary": "During a routine morning triage of my open-source project, git status showed a modified file I had no memory of touching: extension/background.js , last modified 24 hours earlier, sitting next to a fresh background.js.bak someone had thoughtfully left behind. Nobody broke in. I run several AI coding sessions in parallel against the same machine, and one of them — working on a completely different…",
  "key_points": [
    "Unknown AI coding session added feature to fix browser automation tool",
    "Code quarantined for three days despite passing tests",
    "Documentation bug discovered, clarified coordinate space and added offset guidance"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}