| name | prioritising-bugs-to-report |
| description | Decide whether a bug found in someone else's crate is actually worth reporting, and how strong a finding it is, before writing it up. Use when triaging a candidate bug, selecting which findings to file upstream, or sanity-checking a severity claim. Guards against reporting documented preconditions, doc-only off-by-ones, and consequences you asserted but never tested.
|
Prioritising bugs to report
Before writing a report, decide whether the finding is real and how strong it is. A weak or overstated report costs a maintainer's goodwill and makes the next one easier to ignore. The bar is not "did something go wrong" — it is "would the maintainer agree this is a bug, and is it as bad as I'm about to say."
Test the consequence before you claim it
The single most common way to overstate a bug is to assert a consequence you reasoned about but never ran. If you're going to say "corrupts the database", "bricks", "leaks", "loses data", "crashes the server" — reproduce that exact outcome end to end first.
The fjall case: an oversized key panicked mid-write and left the keyspace returning Err(Poisoned), so the draft said it "bricks the whole database". Actually reopening the database succeeded fine — the poison was in-memory and cleared on restart. The reopen took one small test to check, and it removed the entire headline. Run that test before the claim goes in, not after someone challenges it.
Corollary: don't count the downstream, expected consequence of a failure as a second, separate severity. A panic while holding a lock poisoning that lock is what Rust does — it is the same bug, not a cascade.
Signals a finding is strong (worth reporting)
- It violates a contract the crate states about itself: its docs, or better, its own property tests / fuzz targets /
debug_asserts / sanity_check. "Your own fuzz target asserts this roundtrip and here's an input that breaks it" is close to unarguable.
- It is oracle-independent — you don't need a second implementation to agree it's wrong: memory unsafety (OOB, UB, violations), silent data corruption, a self-roundtrip failure (, ), or a violated invariant the crate itself checks elsewhere.
