OKPN/OMPV as a security lens: 4 recent incidents all trace to data shapes

The piece follows up on an earlier post that gave names to two code-review lenses. OKPN asks whether a single name carries only one kind of value, while OMPV asks whether a single value carries only one meaning; the bonus "null trap" rule says a missing value should be omitted rather than represented as null.

The author deliberately frames the exercise narrowly. Rather than claim these principles would have prevented the four incidents, the post argues that disordered data shapes were the trigger or entry point in each case. Next.js packed a call history into a colon-separated internal header, React2Shell packed a reference and a property path into one string like "$3:constructor:constructor," and OttoKit treated an empty string as a valid API key, making "no key configured" indistinguishable from a match. Google Cloud's June 12 outage came from blank fields in policy data that a new check did not anticipate.

Notably, the author used Claude to check the four cases against primary sources. The closing observation is that letting AI write code tends to produce colon-packed values and returned nulls readily, and that the most convenient shape in the moment often turns out to be the most expensive later.