IT risk has shifted almost entirely to data

We'll fix it in prod, right?

It used to be that a 1000-line code commit was a big deal. It deserved respect and scrutiny, reviews and sign-offs. It meant something big has changed. If a junior dev did it, its time-to-land could be a couple of days, usually because someone senior had to read it and understand it well enough to OK it.

That was going through my mind while I was looking at a 10k+ PR that did Something Important, created by Claude.

What’s the worst that can happen?

Problems caused by bad code were expensive to debug because of the time it took to understand them. Simply reading code and thinking about what it does, especially in the (very common) case where there are concurrent things going on, took man-hours. It was kind-of usual to block all new work in a team until a tricky problem was eradicated.

Now, it’s more often than not solved by “Hey Claude, the auth keys to the log server and the db snapshot are in .env, and the error message is ‘foo’ - investigate”.

The cost of code-level mistakes has gotten dramatically down, and that dragged down the risk factors for many cases of problems. The ones that didn’t change, and probably never will, are risks associated with data.

The code can be wrong, the calculations off, but unless it’s causing problems with the data, the fix could be 1 prompt away.

Corrupted data, inadvertently deleted data, or leaked data, is where the panic starts now. Data is king - the code is cheap (and it’s the king because, again, it’s expensive to fix). At least that’s my take on what parts of 10k+ PRs deserve a second look.