My open-source project, safari-mcp , got a security-hardening pull request from an automated scanner. The idea behind the patch was right. The patch itself un-parsed the codebase. Then the same defect infected my review of the patch, my review of the fix, and eventually the private note I wrote to remind myself to stop letting this happen. This is a story about one character, told in three acts, and it ends with a rule I now apply to everything I publish. The character U+202...