A guard that cries wolf is worse than no guard

What it said

We built a checker so the payment-wiring failure could never recur. Its first run against the real system printed two things in capital letters.

STOP  A LIVE key aimed at preview. Staging is public — this charges real cards.

STOP  Every one of the last 1 payment confirmations failed to deliver.
      That is a signing-secret mismatch. Money in, nothing granted.

Bug one: it guessed the environment

The command took an optional flag saying which environment to check. If you left it off, it defaulted to preview.

So a live key checked against a production URL was compared against preview, and reported as a catastrophe. The key was fine. The comparison was against an environment nobody had asked for.

A guard must fail closed on ambiguity, not guess. It now refuses to run until you say which environment you mean. Guessing is fine for a convenience; it is never fine for something whose whole job is to tell you the truth.

Bug two: it read shared infrastructure as if it were ours

It listed payments from the Stripe account. That account serves six products. So another product's failed delivery was reported as this product's money taken and nothing granted.

Our own checkouts carry an internal id in their metadata and nobody else's do. That is the filter now. Anything reading shared infrastructure has to identify its own work — an account, a queue and a log are all shared surfaces where this same mistake is waiting.

Bug three: it did not recognise its own placeholder

The command is handed to a person to copy and run. So it was run with the placeholder still in it, and the error came back from Stripe rather than from us.

Could not complete: Invalid API Key provided: sk_live_xxx

The cost

Two false alarms, on the first run, on the money path. The person reading them had no way to know which parts to believe — and the correct response to a checker you cannot trust is to stop running it.

A guard's failure mode is not "it missed something". It is "it said something untrue and you stopped listening". Budget more care for the false positives than the false negatives.