Pragmatic Engineer's 2023 Stripe profile covered a 20M-line Ruby codebase and strict API review
Pragmatic Engineer spent months talking with David Singleton, then Stripe's CTO, for a December 2023 profile of engineering at a company of about 7,000 people. The excerpt covers scale, stack and process but does not show how Stripe assigned a directly responsible individual, so that practice cannot be benchmarked from it.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+15
- Incentives45
- Confidence40
buildOne report1 publisher Uber Eats halved search time through many fixes, the largest around 200 ms
Uber Eats halved its search wait with no single change worth more than about 200 ms, a DEV Community summary of Uber Engineering's post says. The biggest saving came after Uber started timing the first fully drawn screen on the phone.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+8
- Incentives30
- Confidence50
buildOne report1 publisher Go 1.27 lets go build pass code that go test rejects under a new stdversion check
DEV Community's Go 1.27 guide says most modules need one go.mod line and a go fix pass, plus a handful of changes that bite silently. Some fail the build outright and others pass it, so the order is build, test, then fix.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher CVE-2026-88008 lets an h2c Upgrade header carry requests past Traefik's BasicAuth and rate limits
In CVE-2026-88008, Traefik tunnels raw bytes once a backend answers a client's h2c Upgrade with 101, so later HTTP/2 requests bypass every middleware. According to a DEV Community write-up, the tunnel opens only when the backend accepts the upgrade.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap
- Not scored
- Incentives
- Not scored
- Confidence58
buildOne report1 publisher Only Go and vcpkg verified every download by default in Trail of Bits' test of 25 package managers
Trail of Bits found that only Go and vcpkg checked every download by default among 25 package managers facing a simulated malicious repository. Teams on the other 23 cannot assume a setting exists, since some tools need extra configuration and some lack the feature.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence55
buildOne report1 publisher Go teams can drop ptr[T] helpers now that Go 1.26 lets new() take an expression
Go 1.26, released February 10, 2026, lets the built-in new() take an expression such as new(42) or new(time.Now()). Teams with ptr[T] or StringPtr helpers can preview a rewrite with go fix -diff -newexpr before deleting anything.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence60
buildOne report1 publisher OpenSSL rejects pre-renewal leaves when only the renewed same-key cert-manager CA is trusted
cert-manager v1.21.2 renewed a same-key CA with a truncated SHA-256 Subject Key Identifier where v1.18.6 had issued a SHA-1 one. In a lab run, OpenSSL 3.0.13 verified a pre-renewal leaf only while the old CA stayed in the trust store.
Reality
- Evidence72
- Adoption
- Not scored
- Hype gap−10
- Incentives
- Not scored
- Confidence68
Trail of Bits test finds 23 of 25 package managers skip integrity checks on some downloads
Only two of 25 popular package managers verified every package they downloaded in a Trail of Bits test. Fewer than half checked lockfiles for tampering by default, leaving many open to a compromised repository that injects code, the post says.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence60
Google finds local patches triple the median effort of updating an open-source package
Google measured 54 updates to its internal copies of open-source packages and found a median effort of 2.2 engineering hours. Private patches raise the cost of a typical update in that data, but the longest updates trace to repair work.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+15
- Incentives
- Not scored
- Confidence50
buildOne report1 publisher Upgrading to Go 1.27 changes the engine under encoding/json before you touch an import
Go 1.27 now runs encoding/json on the v2 engine, so error message text can change on upgrade, according to a dev.to post. Changing an import to encoding/json/v2 flips four defaults, and some of the changes raise no error.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence62
buildOne report1 publisher Theo Browne's AI-written tsc-rs type-checks VS Code 13x faster than tsc 6
Theo Browne's AI-written Rust port of the TypeScript compiler type-checks VS Code 13x faster than tsc 6 and cost over $420,000 in tokens. Browne says he never read the code, so the 181,711 ported tests it passes are the main evidence that it behaves correctly.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+30
- Incentives35
- Confidence55
buildOne report1 publisher OpenTofu 1.13 turns documented provider guarantees into plan-time answers
OpenTofu 1.13 adds assume functions that let module authors declare an unknown value's shape, so null and prefix checks get answered at plan time. Plan reviews lean less on guesswork wherever shared modules wrap their outputs this way.
Reality
- Evidence58
- Adoption
- Not scored
- Hype gap+10
- Incentives25
- Confidence62
buildConfirmed14 publishers Google stopped taking product vulnerability reports for its open-source bug bounty on October 1 after a flood of invalid AI-generated submissions. Any team that takes outside security reports faces the same imbalance, with reports now cheap to write and as costly as ever to check.
Perspective Coverage
15 publishers
- Builder
- Builder 41%
- Operator
- Operator 50%
- Investor
- Investor 9%
Reality
- Evidence76
- Adoption55
- Hype gap+20
- Incentives35
- Confidence72
buildOne report1 publisher Gomponents v1.4.0 trims memory allocations from Go HTML component rendering
Gomponents v1.4.0 speeds up the six-year-old Go HTML component library by cutting heap allocations, according to a dev.to write-up. The post says the changes stay behind the public API, so Go teams can treat the upgrade as a version bump and a test run.
Reality
- Evidence25
- Adoption
- Not scored
- Hype gap+40
- Incentives
- Not scored
- Confidence30
buildOne report1 publisher Hansson's agent-built Rust Campfire posts a 166-fold benchmark gain on code he never inspected
David Heinemeier Hansson's agent-written Rust port of Campfire served 36,120 room-page requests a second to Rails' 217 in 37signals' own benchmark. A parity harness checks its behavior against Rails, but the numbers are company-run and stop short of production traffic.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+30
- Incentives50
- Confidence40
buildOne report1 publisher Go 1.27 executes a poisoned dependency at go test in a replay of npm's August 4 worm
Go 1.27 ran none of a poisoned module's code on go get, go build or go vet in a replay of npm's August 4 worm, but go test ran it with GITHUB_TOKEN in reach. Go teams still carry exposure through CI test runs, versions that stay cached for good, and bots that edit go.mod.
Reality
- Evidence50
- Adoption
- Not scored
- Hype gap+5
- Incentives
- Not scored
- Confidence55
buildOne report1 publisher Google's pkg.go.dev API reaches v1 with eight JSON endpoints aimed at coding agents
Google has moved the pkg.go.dev API from v1beta to v1, giving Go tools and coding agents eight stateless JSON endpoints for package data. Programs that scraped the site's HTML can now build against a contract Google says it designed for agents and LLMs.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+25
- Incentives65
- Confidence40
buildOne report1 publisher TypeScript 7's Go compiler speedup scales with how much of your build is tsc
Microsoft's Go port of the TypeScript 7 compiler cut VS Code's full build from 125.7 to 10.6 seconds in its benchmarks. Tools that import TypeScript as a library may still need the TypeScript 6 API, so the upgrade belongs on a throwaway branch first.
Reality
- Evidence40
- Adoption
- Not scored
- Hype gap+15
- Incentives50
- Confidence45
buildOne report1 publisher A stale appearance stream lets a filled PDF form keep showing the value it replaced
PDF libraries can write a form field's new /V value and leave the old /AP appearance on the page, a dev.to guide on redaction warns. For personal data, the guide makes a check of the rendered pixels the release gate, because exit codes pass either way.
Reality
- Evidence46
- Adoption
- Not scored
- Hype gap+3
- Incentives22
- Confidence52
buildOne report1 publisher A conditional SQL update should decide when a 10-minute inventory hold expires
Reservation expiry belongs in the database row, a dev.to guide argues, because 300 holds ending at once need five minutes of a 60-per-minute notification API. With the two separated, a throttled notification backlog can grow for minutes without keeping a single item off sale.
Reality
- Evidence35
- Adoption
- Not scored
- Hype gap−5
- Incentives
- Not scored
- Confidence40