Ops / Incidents I built a safety tool for the AWS Console that switched itself off for 6 seconds every time you used it
I wrote a browser extension that adds a "you're in PROD, are you sure?" confirm to destructive AWS Console clicks. Capture-phase listener cancels the click, shows a dialog, replays the click if you confirm.
Trouble: some actions re-render their menu between confirm and replay, so the replayed click hit a detached node and did nothing. My fix was a short bypass window after confirming — for a few seconds, clicks pass straight through so the replay works.
The window wasn't scoped to the action you confirmed. It was global. So for ~6 seconds after confirming any destructive action, every other one was unguarded. Confirm a Lambda delete, click Terminate on an EC2 instance three seconds later, and it just goes.
A tester reported it as "the popup stops appearing sometimes." Not a UI glitch — the guardrail was switching itself off, on a timer, every time it ran.
Fix is one line — scope the window to the confirmed action:
// before
if (Date.now() < bypassUntil) return;
// after
if (Date.now() < bypassUntil && rule.label === bypassLabel) return;
The lesson that stuck: a bypass is a security control too. I wrote mine as a UI workaround, so I reviewed it like a rendering bug, not a security decision. Anything that turns your protection off — even briefly — deserves the same scrutiny as the protection itself.
Anyone else hit this class of bug — a temporary exception that was broader than intended — in auth caches, feature flags, rate-limit bypasses?
