Defect three is the part worth stealing. There is a limiter, it stores `lastAttemptAt`, and it compares against a window; the bug is that it rewrites the timestamp on every request, including the ones it rejects, so the window slides forward on each rejection and a user who hits the limit once never gets back in [11]. Reading the code tells you a limiter exists. Tracing a second request through it tells you the limiter is a lockout, and the interviewer's tally is that everyone sees the limiter and almost nobody traces the second request [12].
Defect four is tuned the same way, to deployment rather than control flow. The old code still reads `verification_token`, the migration drops it, and the PR removes the reads, so unless those land in that exact order you get a few minutes of 500s, and they will not land in that order because instances roll one at a time [13]. He reports that backend candidates who have actually shipped catch this and nobody else does [14]. That is a fixture calibrated on rolling deploys. Cut over atomically and defect four stops being a defect, which also means it stops discriminating.
Six lines a minute is the reading budget: 180 lines, 30 minutes [2]. The candidate who opened with camelCase on line 43 spent ten minutes, a third of the slot, on one nit [1], and the account's own framing is that the failure mode is spending your best minutes on formatting nits an autoformatter would have caught, rather than missing a bug [20]. The sixth seeded item, a leftover `console.log` and one inconsistent name, is bait for precisely that reflex [16].
Context is the other lever. Half the seeded defects only look like defects once you know the endpoint is public and unauthenticated, and the interviewer says he answers that honestly when asked but will not volunteer it [18]. Severity here is not a property of the diff. It is a property of the diff plus a fact the candidate has to go and get.
The base rate is where the account is thinnest. Two candidates out of many have ever named the user enumeration issue unprompted, the 404 for unknown accounts against the 200 for real ones, which he ranks as the highest-severity thing in the file [8][9]. Two out of what, though. For that to say something about engineers rather than about one pipeline, you would need the denominator, the seniority mix, and whether the status-code asymmetry is visible in the diff at all or only by reading the handler. None of that is in the write-up. He has run the format for three years and prefers it to any algorithm question he has asked [3][22]; no hire outcomes are attached to the preference.
What ports is the constraint he names, a real review with fourteen PRs in the queue and finite attention [21]. Without a written ranking checked against an incident from your own repo, the score measures how closely a candidate guesses the interviewer's priorities.
