It Ran Fine in Production. Then I Wrote the Tests.

The app worked. Users could log in. Data was saving. Nobody was on fire. So naturally, I went looking for the fire. I was asked to audit a new Agent Referral feature on a school management system — agents refer schools, earn commissions, the usual. No brief. No checklist. Just "make sure it's fine." It was not fine. Nothing was visibly broken, but the architecture had been quietly making peace with some genuinely bad decisions. Everything held together by vibes and accumulated runtime state. Here's what I found — and why it matters whether you're writing PHP, Python, Go, or whatever language you've convinced yourself won't betray you. The Back Door That Was Literally Labelled There was a helper method — resolveAgent() — whose job was to figure out which agent was logged in. Two steps: Check if the authenticated user is an Agent ✅ If not — check if the URL has an agent_id parameter, and if so, load that agent from the database ❌ Step 2 is called Priv