Tightening a file's permissions is supposed to be the safe direction. In July, on my search engine's frontend server, setting the application's .env file to mode 0600 instead did two things at once: it broke every newly started PHP process, and it left the admin area answering without a password for a few minutes. A smoke test after the deploy caught it.
In October, CaRMen, my CRM, got an endpoint for something other than a logged-in person: a website contact form that should be able to create a lead without anyone logging in. That needs an API key, and an API key is a password that's meant to be pasted into other systems.
This build's wifi documentation got rewritten once the desktop environment grew a GUI network applet — not because the original instructions were wrong, but because a second, complete way to do the same thing now existed alongside the first, and the two actively fight each other if both run at once.
In July, while debugging a data export script for my search engine, I ran ps aux on the server as part of the diagnosis. The output contained the application's MySQL password, in plain text, because the script passed it on the command line.
A method's own comment already explained exactly what its SQL needed to do, and why. The actual SQL did the opposite of what the comment described.
Linux From Scratch builds coreutils with an extra patch, the i18n patch, which adds multibyte character support to tools like cut and expand. In my scripted LFS build, applying that one patch took four rounds of fixes spread over eleven days.
CaRMen's backend container builds its Docker image from a Dockerfile that runs composer install during the build, so the image ships with a real, populated /app/vendor baked in.
CaRMen, my CRM, runs on a single VPS as two instances: the real one and a public demo. In October, I gave it a deploy script that can undo itself when a new version doesn't come up, including, when it has to, the database. The database is the interesting part.
CaRMen's customer section used to be split across two controllers for no particular reason: CustomerController owned the list and detail pages, and a generic WebController owned the "add new customer" form, declared as its own route:
#[Route('/customer/add', name: 'customer_add')]
CaRMen didn't have a setup flow for most of its life. Getting a fresh instance running meant running migrations by hand and inserting the first admin user directly through a database client — fine for a one-person project, less fine the moment I wanted to hand someone else a copy of the app without also handing them a shell.