The five-minute grep: what `synchronize: true` tells a reviewer before your tests do

Grepping for `synchronize` is efficient because one line answers a question that otherwise takes an afternoon: does anyone own this schema? The setting rebuilds tables from entity classes on every boot, which leaves no migration history, no review step when the shape of the data changes, and a renamed column sitting one deploy away from data loss ^[4].

Flipping the default to false and switching on `migrationsRun` is the easy half ^[6]. Generating the baseline is where this could have gone quietly wrong. The data source that feeds the TypeORM CLI had been carrying a hand-listed subset of four entity classes, while the baseline it was meant to describe covers 16 tables across auth and billing ^[8][2]. Run as it stood, `migration:generate` would have emitted something that looked like a full schema and left the rest out ^[8]. Nothing errors in that scenario; the baseline is simply short, and every migration after it inherits the hole. The author's precaution was to generate against an empty throwaway Postgres and then apply the output to confirm it stands up ^[7], which is the only way to learn whether the entity glob is honest.

The compose file arithmetic is worth doing. Six logical secrets written eighteen times collapse into six interpolation variables, which removes twelve places where a value can be edited out of step with its twin ^[1]. The twins mattered: the same JWT secret was pasted into three service blocks, with auth signing and both zerotrust and billing verifying, so one careless edit produces cross-service auth failures that look like anything except a typo ^[12]. The same change fixes the duller complaint, which is that a secret baked into a tracked file cannot be overridden without editing the repository ^[12]. Real values now come from a gitignored root `.env`, with a fallback named `dev-insecure-*` so `docker compose up` and CI still run with no setup ^[13]. The production overlay drops the fallbacks and uses the `:?` form, so a missing variable stops compose instead of booting the stack on a placeholder ^[14].

Two of the three findings are reading problems: nothing misbehaves, the repo just reads badly. The third is different. Internal service-to-service calls and vault's Zero Trust requests are HMAC-signed with a nonce, and replay rejection depends on remembering those nonces for a short window in a per-process `Map` ^[16]. That is a functional limit rather than a matter of taste, and it is the one item on the list a reviewer and a load test would both find.

For a product whose buyers are engineers, the repository is part of the surface being evaluated; the person deciding whether to trust it opens it rather than clicking through the demo ^[2].