Configuration, Constants & Feature Flags — Find the Bug¶

12 snippets where a config value, a constant, or a feature flag turns into a production incident. Every bug here is not in the logic — the logic is fine. The bug is in the value that governs the logic: a duplicated magic number that drifted, a stringly-typed timeout parsed in the wrong unit, a missing env var that defaulted to localhost, an immortal flag that fired dead code. Find the defect before opening the answer.

Table of Contents¶

1. Duplicated buffer size that drifted (Go)
2. Stringly-typed timeout, wrong unit (Python)
3. Missing env var defaults to localhost in prod (Go)
4. Boolean-trap call with swapped flags (Java)
5. The immortal flag firing dead code — Knight Capital (Java)
6. Environment detection by hostname breaks in a new region (Go)
7. Mutable global config mutated mid-request (Python)
8. Secret logged at startup (Java)
9. MB vs MiB unit mismatch from an untyped constant (Go)
10. Flag default differs between services — split brain (Python)
11. Magic-string status compared against a renamed constant (Java)
12. Config read once at import time, env set later (Python)
13. Scorecard
14. Related Topics

How to Use¶

Read each snippet and decide what breaks before expanding the answer. These bugs do not announce themselves: the code compiles, the happy path passes in CI, and the failure shows up only under a specific value, a specific environment, or a specific point in the deployment lifecycle. For each one, ask the four configuration questions:

• Where does this value live? One source of truth, or copies that can drift?
• What type is it, really? A string that means a duration, a size, a boolean?
• When is it read? At startup (fail-fast), per-request, or frozen at import time?
• What happens when it is absent or wrong? Fail loud, or default silently into a worse state?

The config lifecycle that ties these together:

Snippet 1 — Duplicated buffer size that drifted (Go)¶

Difficulty: Easy

A framing protocol reads fixed-size records off a socket. The writer and the reader live in different files.

// file: writer.go
const frameSize = 1024

func writeFrame(conn net.Conn, payload []byte) error {
    buf := make([]byte, frameSize)
    copy(buf, payload)            // payload is padded to frameSize
    _, err := conn.Write(buf)
    return err
}

// file: reader.go
// (six months later, someone "tuned" this for throughput)
const readBufferSize = 4096

func readFrame(conn net.Conn) ([]byte, error) {
    buf := make([]byte, readBufferSize)
    n, err := io.ReadFull(conn, buf)
    if err != nil {
        return nil, err
    }
    return buf[:n], nil
}

What's wrong?

// file: protocol.go
const FrameSize = 1024 // network frame size, bytes. Writer and reader MUST agree.

// writer.go
buf := make([]byte, protocol.FrameSize)

// reader.go
buf := make([]byte, protocol.FrameSize)

Snippet 2 — Stringly-typed timeout, wrong unit (Python)¶

Difficulty: Easy

A worker reads its HTTP timeout from configuration.

import requests

config = {
    "upstream_url": "https://payments.internal/charge",
    "request_timeout": "30",   # operator set this to "30 seconds"
}

def charge(payload):
    timeout = int(config["request_timeout"])
    return requests.post(
        config["upstream_url"],
        json=payload,
        timeout=timeout,
    )

What's wrong?

from dataclasses import dataclass

@dataclass(frozen=True)
class WorkerConfig:
    upstream_url: str
    request_timeout: float  # SECONDS

    @classmethod
    def load(cls, raw: dict) -> "WorkerConfig":
        try:
            timeout = float(raw["request_timeout"])
        except (KeyError, ValueError) as e:
            raise SystemExit(f"invalid request_timeout: {raw.get('request_timeout')!r}: {e}")
        if not (0 < timeout <= 120):
            raise SystemExit(f"request_timeout out of range: {timeout}s")
        return cls(upstream_url=raw["upstream_url"], request_timeout=timeout)

# at boot:
CONFIG = WorkerConfig.load(raw_config)   # crashes here, loudly, before serving traffic

Snippet 3 — Missing env var defaults to localhost in prod (Go)¶

Difficulty: Medium

Database wiring for a service deployed across environments.

func getEnv(key, fallback string) string {
    if v := os.Getenv(key); v != "" {
        return v
    }
    return fallback
}

func NewDBConfig() DBConfig {
    return DBConfig{
        Host:     getEnv("DB_HOST", "localhost"),
        Port:     getEnv("DB_PORT", "5432"),
        User:     getEnv("DB_USER", "postgres"),
        Password: getEnv("DB_PASSWORD", ""),
        Name:     getEnv("DB_NAME", "app_dev"),
    }
}

What's wrong?

func requireEnv(key string) string {
    v := os.Getenv(key)
    if v == "" {
        log.Fatalf("required env var %s is not set", key) // fail loud, at boot
    }
    return v
}

func NewDBConfig() DBConfig {
    return DBConfig{
        Host:     requireEnv("DB_HOST"),     // no localhost fallback
        Port:     getEnv("DB_PORT", "5432"), // safe default, ok
        User:     requireEnv("DB_USER"),
        Password: requireEnv("DB_PASSWORD"),
        Name:     requireEnv("DB_NAME"),
    }
}

Snippet 4 — Boolean-trap call with swapped flags (Java)¶

Difficulty: Easy

A reporting service exports user data.

public byte[] exportUsers(
        boolean includePII,
        boolean compress,
        boolean encrypt) {
    List<User> users = repo.findAll();
    byte[] data = serialize(users, includePII);
    if (compress) data = gzip(data);
    if (encrypt)  data = aes256(data);
    return data;
}

// Caller — a nightly job that ships an export to a third-party analytics vendor:
byte[] export = reporter.exportUsers(true, true, false);
upload(vendorBucket, export);

What's wrong?

public record ExportOptions(
        boolean includePII,
        boolean compress,
        boolean encrypt) {

    public static ExportOptions forExternalVendor() {
        return new ExportOptions(false, true, true); // never PII, always encrypted
    }
}

public byte[] exportUsers(ExportOptions opts) { ... }

// Caller — meaning is now self-evident and the safe path is a named factory:
byte[] export = reporter.exportUsers(ExportOptions.forExternalVendor());

Snippet 5 — The immortal flag firing dead code — Knight Capital (Java)¶

Difficulty: Hard

An order router has a kill-switch–style flag that controls which execution path runs. This is modeled on the 2012 Knight Capital incident.

public class OrderRouter {

    // Feature flag, read once at deploy from config service.
    private final boolean powerPeg;

    public OrderRouter(FlagService flags) {
        // "power_peg" was a routing strategy retired years ago.
        this.powerPeg = flags.isEnabled("power_peg");
    }

    public void route(Order order) {
        if (powerPeg) {
            // OLD code path, dead since 2005, never removed.
            powerPegStrategy.execute(order);   // buys high, sells low in a loop
        } else {
            smartRouting.execute(order);
        }
    }
}

A new feature, smart_routing_v2, is rolled out by reusing the old power_peg flag key in the flag service (someone repurposed the dormant key instead of creating a new one), and deploying the new code to 7 of 8 servers.

What's wrong?

public void route(Order order) {
    // power_peg branch was deleted in 2006. There is nothing to re-arm.
    smartRouting.execute(order);
}

// FlagService refuses unknown/retired keys instead of returning a stale boolean:
boolean enabled = flags.requireKnown("smart_routing_v2"); // throws on retired/unknown key

Snippet 6 — Environment detection by hostname breaks in a new region (Go)¶

Difficulty: Medium

A service decides whether it is in production by inspecting its own hostname.

func isProd() bool {
    host, _ := os.Hostname()
    // prod hosts are named like "prod-web-01.us-east-1.internal"
    return strings.HasPrefix(host, "prod-")
}

func sendEmail(to, body string) error {
    if !isProd() {
        // In non-prod, redirect all mail to a catch-all test inbox.
        to = "qa-catchall@example.com"
    }
    return mailer.Send(to, body)
}

The company opens a new region, eu-west-1, where the platform team names production hosts eu-prod-web-01.eu-west-1.internal.

What's wrong?

type Env string

const (
    EnvDev   Env = "dev"
    EnvStage Env = "stage"
    EnvProd  Env = "prod"
)

func loadEnv() Env {
    v := Env(os.Getenv("APP_ENV"))
    switch v {
    case EnvDev, EnvStage, EnvProd:
        return v
    default:
        log.Fatalf("APP_ENV must be one of dev|stage|prod, got %q", v) // fail-fast
    }
    panic("unreachable")
}

func sendEmail(env Env, to, body string) error {
    if env != EnvProd {
        to = "qa-catchall@example.com"
    }
    return mailer.Send(to, body)
}

Snippet 7 — Mutable global config mutated mid-request (Python)¶

Difficulty: Hard

A web app keeps a global config dict and lets an admin endpoint update it live.

CONFIG = {
    "currency": "USD",
    "tax_rate": 0.0875,
    "rounding": "half_up",
}

def admin_update_config(key, value):
    CONFIG[key] = value          # live update, no restart needed

def checkout(cart):
    subtotal = sum(item.price for item in cart.items)
    tax = subtotal * CONFIG["tax_rate"]          # read 1
    total = subtotal + tax
    receipt = format_money(total, CONFIG["currency"])  # read 2
    log_sale(subtotal, tax, CONFIG["tax_rate"])        # read 3
    return receipt, total

checkout runs concurrently across many worker threads. An admin calls admin_update_config("tax_rate", 0.10) and, in a separate call, admin_update_config("currency", "EUR").

What's wrong?

from dataclasses import dataclass

@dataclass(frozen=True)
class Config:
    currency: str
    tax_rate: float
    rounding: str

_current = Config("USD", 0.0875, "half_up")  # the live snapshot

def get_config() -> Config:
    return _current  # atomic reference read; the object is immutable

def admin_update_config(**changes):
    global _current
    _current = replace(_current, **changes)  # atomic swap of a fully-formed snapshot

def checkout(cart):
    cfg = get_config()                 # one consistent snapshot for the whole request
    subtotal = sum(i.price for i in cart.items)
    tax = subtotal * cfg.tax_rate
    total = subtotal + tax
    receipt = format_money(total, cfg.currency)
    log_sale(subtotal, tax, cfg.tax_rate)   # same snapshot — log always matches charge
    return receipt, total

Snippet 8 — Secret logged at startup (Java)¶

Difficulty: Easy

A service logs its resolved configuration on boot to aid debugging.

public class AppConfig {
    private final String dbUrl;
    private final String dbUser;
    private final String dbPassword;
    private final String stripeApiKey;

    @Override
    public String toString() {
        return "AppConfig{" +
                "dbUrl=" + dbUrl +
                ", dbUser=" + dbUser +
                ", dbPassword=" + dbPassword +
                ", stripeApiKey=" + stripeApiKey +
                '}';
    }
}

// On boot:
log.info("Starting with config: {}", appConfig);

What's wrong?

public final class Secret {
    private final String value;
    public Secret(String value) { this.value = value; }
    public String reveal() { return value; }      // explicit, greppable
    @Override public String toString() { return "***REDACTED***"; }
}

public class AppConfig {
    private final String dbUrl;
    private final String dbUser;
    private final Secret dbPassword;
    private final Secret stripeApiKey;

    @Override public String toString() {
        return "AppConfig{dbUrl=" + dbUrl + ", dbUser=" + dbUser +
               ", dbPassword=" + dbPassword +     // -> ***REDACTED***
               ", stripeApiKey=" + stripeApiKey + '}';
    }
}

Snippet 9 — MB vs MiB unit mismatch from an untyped constant (Go)¶

Difficulty: Medium

An upload handler enforces a maximum file size that operators configure "in MB."

// Operators configure MAX_UPLOAD_MB=10 meaning "10 megabytes".
const bytesPerMB = 1000 * 1000 // decimal megabyte

func maxUploadBytes() int64 {
    mb, _ := strconv.Atoi(os.Getenv("MAX_UPLOAD_MB"))
    return int64(mb) * bytesPerMB
}

// Elsewhere, a buffer is pre-allocated using a different idea of "MB":
const oneMiB = 1 << 20 // 1024 * 1024

func newUploadBuffer(maxMB int) []byte {
    return make([]byte, maxMB*oneMiB) // pre-allocate the max
}

maxUploadBytes() is used to reject oversized uploads; newUploadBuffer(10) pre-allocates the receive buffer.

What's wrong?

type Bytes int64

const (
    KiB Bytes = 1 << 10
    MiB Bytes = 1 << 20
)

// One definition. The limit and the buffer derive from the SAME value.
func maxUpload() Bytes {
    mb, err := strconv.Atoi(os.Getenv("MAX_UPLOAD_MB"))
    if err != nil {
        log.Fatalf("MAX_UPLOAD_MB invalid: %v", err)
    }
    return Bytes(mb) * MiB // documented: MB here means MiB
}

func newUploadBuffer(limit Bytes) []byte {
    return make([]byte, limit) // identical units, identical source
}

// usage: both the gate and the buffer use one value
limit := maxUpload()
buf := newUploadBuffer(limit)

Snippet 10 — Flag default differs between services — split brain (Python)¶

Difficulty: Hard

A producer service and a consumer service both gate the same new wire format behind a flag, but each defines its own default.

# ---- producer service: orders-api ----
def use_v2_format() -> bool:
    # default True: the producer team already shipped and tested v2
    return os.getenv("ENABLE_V2_FORMAT", "true").lower() == "true"

def publish(order):
    if use_v2_format():
        payload = encode_v2(order)   # new schema, extra fields, different envelope
    else:
        payload = encode_v1(order)
    queue.put(payload)

# ---- consumer service: fulfillment-worker (different repo, different team) ----
def use_v2_format() -> bool:
    # default False: the consumer team hasn't finished v2 support yet
    return os.getenv("ENABLE_V2_FORMAT", "false").lower() == "true"

def handle(payload):
    if use_v2_format():
        order = decode_v2(payload)
    else:
        order = decode_v1(payload)   # will mis-parse a v2 envelope
    fulfill(order)

Both services deploy to an environment where ENABLE_V2_FORMAT is not set (nobody added it to that env's config).

What's wrong?

# shared config library imported by BOTH services
def wire_format_v2_enabled() -> bool:
    raw = os.getenv("ENABLE_V2_FORMAT")
    if raw is None:
        raise SystemExit("ENABLE_V2_FORMAT must be set explicitly (no default for a wire-format flag)")
    return raw.lower() == "true"

Snippet 11 — Magic-string status compared against a renamed constant (Java)¶

Difficulty: Medium

An order state machine checks status with string literals in some places and a constant in others.

public class OrderStatus {
    public static final String SHIPPED = "SHIPPED";
    // A refactor renamed the persisted value from "COMPLETE" to "COMPLETED"
    // and updated this constant — but missed an inline literal elsewhere.
    public static final String COMPLETED = "COMPLETED";
}

public boolean canRefund(Order order) {
    // uses the constant — correct
    return order.getStatus().equals(OrderStatus.COMPLETED)
        || order.getStatus().equals(OrderStatus.SHIPPED);
}

public boolean isFinal(Order order) {
    // uses an inline magic string — NOT updated during the rename
    return order.getStatus().equals("COMPLETE")
        || order.getStatus().equals("CANCELLED");
}

What's wrong?

public enum OrderStatus {
    PENDING, SHIPPED, COMPLETED, CANCELLED;

    public boolean isFinal()  { return this == COMPLETED || this == CANCELLED; }
    public boolean canRefund(){ return this == COMPLETED || this == SHIPPED; }
}

public boolean isFinal(Order order)  { return order.getStatus().isFinal(); }
public boolean canRefund(Order order){ return order.getStatus().canRefund(); }

Snippet 12 — Config read once at import time, env set later (Python)¶

Difficulty: Medium

A module computes its config at import time.

# settings.py
import os

# evaluated the moment this module is first imported
FEATURE_NEW_PRICING = os.getenv("FEATURE_NEW_PRICING", "false").lower() == "true"
PRICING_REGION = os.getenv("PRICING_REGION", "us")

# pricing.py
from settings import FEATURE_NEW_PRICING, PRICING_REGION

def price(item):
    if FEATURE_NEW_PRICING:
        return new_pricing(item, PRICING_REGION)
    return legacy_pricing(item)

A test (and, separately, a worker bootstrap script) sets the environment after importing the application:

# conftest.py / bootstrap.py
import app                      # this imports settings.py -> reads env NOW
import os
os.environ["FEATURE_NEW_PRICING"] = "true"   # too late
os.environ["PRICING_REGION"] = "eu"          # too late

What's wrong?

# settings.py
import os
from functools import lru_cache
from dataclasses import dataclass

@dataclass(frozen=True)
class Settings:
    feature_new_pricing: bool
    pricing_region: str

@lru_cache(maxsize=1)
def get_settings() -> Settings:
    return Settings(
        feature_new_pricing=os.getenv("FEATURE_NEW_PRICING", "false").lower() == "true",
        pricing_region=os.getenv("PRICING_REGION", "us"),
    )

# pricing.py
from settings import get_settings

def price(item):
    s = get_settings()                 # resolved on first call, after env is set
    if s.feature_new_pricing:
        return new_pricing(item, s.pricing_region)
    return legacy_pricing(item)

Scorecard¶

Tally how many you diagnosed correctly before opening the answer.

Scoring:

• 10–12 correct — You read config the way you read code: with suspicion. You instinctively ask "where does this value live, what type is it really, and when is it read?" Senior-level instincts.
• 6–9 correct — Solid. You catch the obvious duplication and boolean traps; sharpen your eye for timing bugs (snippets 7 and 12) and cross-service defaults (snippet 10), which hide best.
• 3–5 correct — You see bugs in logic but trust configuration too much. The lesson of this chapter: a value is as dangerous as a function. Re-read snippets 5, 7, and 10.
• 0–2 correct — Start with the positive rules in the chapter README, then return. Configuration bugs are over-represented in real outages precisely because they look harmless.

The pattern across every bug: the logic was never wrong. The value that governs the logic was duplicated, mistyped, defaulted, mutated, or never retired. Treat config, constants, and flags with the same rigor you give the code they steer.

Related Topics¶

• junior.md — the foundational rules: named constants, single source of truth, fail-fast validation.
• tasks.md — hands-on exercises to harden config: typed settings, flag retirement, secret redaction.
• Chapter README — the positive rules and the full anti-pattern list for configuration.
• Anti-Patterns — the immortal-flag and stringly-typed config smells in their broader catalog.
• Refactoring — Replace Magic Number/String with Symbolic Constant, Introduce Parameter Object, and Encapsulate Field, which fix several bugs above.