Pinning a GitHub Action to a commit SHA doesn’t actually scope it to the repository you think you’re trusting. GitHub will happily resolve and execute that SHA from an attacker-controlled fork.

Dynamics has a version control system where version numbers don’t control versions, the system doesn’t reconcile changes based on version lineage. It just stacks them and shows you whatever is on top.

You don’t get history. You get sediment.

Fetch requests in Cloudflare Workers use http by default, even if you explicitly specify https, which can often cause redirect loops.

JavaScript date objects are 1 indexed for years and days, but 0 indexed for months.

That the BSD version of Grep, Sed etc are not the same as the GNU versions of the same tools and important args don’t always exist. Leading to your scripts either checking for ggrep gsed etc, or checking to see if its the GNU one and failing if not or some other arcane nonsense.

The Cisco ASA firmware upgrade from 8.2 to 8.3, despite being a minor version, contains a breaking change and fundamentally changed NAT.