JavaScript code, judged.

Every time someone loads the product list you run DDL on the table. You wrote a GET endpoint that bullies the schema on every damn request. Calling it "migrate on read" like it's clever is the scariest part.

You named the function "stripTags" and then rendered the result straight into innerHTML with a comment calling it sanitized — that's not sanitization, that's a bouncer who checks IDs by asking if you have one. `onerror=alert(1)` walks right past your little regex and gets handed the keys.

You nested five ternaries into a single return with zero parentheses, so every reader has to parse your operator precedence in their head like it's a punishment. Buffer overflow of the eyes would've been kinder.

You're toggling `isLoading` on every addToCart, so the spinner's job is now inexplicably tied to cart contents. Somewhere a support ticket is being born that says the app is permanently loading because someone added twelve things.

You wrapped a chain of promises in another promise for absolutely no goddamn reason. You invented a fourth callback pyramid because the async/await pyramid was too honest for you. That promise executor won't reject either, so the first fetch error resolves into hell silently.

Setting `result.failed = 0` doesn't fix the tests, it just fixes the number you have to look at. That's not a deploy script, that's a confession with the timestamp built in.

An infinite retry loop with no cap, no delay, no backoff. You built a denial-of-service attack and pointed it at your own API, and the comment says it will work eventually like that's a plan and not a prayer.

Three progressively worse ways to avoid learning how == works, culminating in stringifying everything and praying. same(null, undefined) prints true and that's not a bug, that's a séance.

Three years and two Tuesdays a week of every single production user getting flashbanged by a reload the function above swears cannot happen. That comment dated 2021 is the only archaeology left of somebody who meant to fix it and didn't.

Your entire authorization model is "if confused, grant." The else branch literally comments its own guess and hands over the keys — that's not security, that's a bouncer who lets everyone in and hopes for the best.

You rebuilt Array.isArray from vibes and a push check, so anything with a length and a push is now legally an array. Congratulations, you've invented duck typing for the one function JavaScript already shipped correctly in 2009.

`clearData` reassigns `data` to a fresh object while `window.data` keeps pointing at the corpse of the old one, so your "global state" is now two disconnected piles of shit with the same name. Congratulations, you built a memory leak and a lie in four words.

You wrote a polling loop with setTimeout to wait for jQuery like it's 2009 and the CDN is on dial-up. This isn't initialization, it's a stalker checking if the DOM is awake yet.

You named it deepClone and then handed it a Date, a function and a BigInt, three things JSON.stringify round-trips into either silence or a string. You didn't clone the object, you photocopied it through a fax machine and called the smudge a feature.

while true with an empty catch and no delay. You didn't write retry logic, you wrote a DDoS against your own server with a side of eternal spin. That comment is doing more work than the function ever will.

You reinvented Array.isArray by checking if the thing has a length and a push, which means your function proudly reports a string as an array. "abc".length and "abc".push both exist in the neighborhood you didn't check.

This is a ternary daisy chain wearing a trenchcoat. You wrote a decision tree with no trunk and expected the reader to just vibe with it, and the isRetired check buried four branches deep is a jump scare with a pension.

here, here 2, in loop, total now, here 3. You wrote a function that talks to itself more than it calculates, like a toddler narrating a shit.

Removing `await` to "fix" the race and then just sleeping two seconds hoping the database catches up is not a fix, it's a hostage negotiation with a clock. That `// give it time` comment is you admitting you don't know what the hell is happening, so you made the computer wait and pray like everyone else.

Seven callbacks deep and console.log is the only thing getting closure around here. You built a stairway to hell one indentation at a time and called it a render pipeline.

You named the page size PAGE, made it 23, then hardcoded `.filter((x, i) => i !== 7)` so page seven is just permanently missing an item. That off-by-one with the `-1` means page one starts at index -1, and none of this matters anyway because the silent missing record is the real crime.

Two nested setTimeout calls waiting on a modal like it owes you money. This whole function bends the knee to the render gods and prays 500 milliseconds is enough.

You built a ternary staircase down to a basement nobody asked for and still needed two separate branches for null and undefined like they're different flavors of missing. The color for "I have no idea what this string is" is black, which is also the color of the soul of whoever reads this next.