June was the month I opened the hood.
When you take over a codebase you didn't write, you inherit every shortcut someone took to hit a deadline. I knew that going in. What I didn't expect was how much was hiding there.
API keys sitting in plain text. Credentials committed into files anyone with access could read. Multiple versions of the same streaming agent, none of them clearly the real one. Config that only worked if you already knew which three things to ignore.
Nobody does this on purpose. They do it at 2am because something has to ship. I've done it myself.
The cleanup
I rotated every key. Scrubbed them from history. Added a gate that blocks any commit containing a secret, so it physically can't happen again. Then I picked the real streaming agent, quarantined the rest, and started rebuilding it piece by piece.
The process change. This is the part that mattered most. I stopped letting anything merge on trust. Every change was written test-first. Every change was reviewed by a second AI before it went in, one whose only job was to find what the first one got wrong. It caught things I would have missed. Things that would've broken a live stream in front of a customer.
What I learned
There's a myth that AI makes you sloppy because it lets you move fast. It's the opposite. Moving fast is exactly why you need more discipline, not less. When code is cheap, the system that checks the code becomes the most valuable thing you own.
Six months ago I'd have looked at that codebase and estimated a quarter to fix it. It took weeks.
The mess was never the problem. Not having a system to clean it was.
‹ Back to home