When code hits an unexpected condition, it has to decide what to do. Each tab is a different way to get that decision wrong — fail open, fall back insecurely, or leak secrets to the user.
The auth check defaults to True and swallows exceptions. Any backend
hiccup grants access.
def is_authorized(user):
allowed = True # default = allow
try:
if not check_auth(user):
allowed = False
except Exception:
pass # silently keep allowed=True
return allowed
You are guest. The backend fails ~50% of the time.
"By error" climbs each time access is granted on the exception path.
attempts: 0 | granted: 0 | by error: 0