Wednesday Code Autopsy · #13

Two Invisible Bugs: One Python Hid, One That Accused NVIDIA

My code worked perfectly on my machine. That's exactly why it was broken for everyone else.

By Marcin Firmuga·2026-06-17·5 min read·Wednesday Code Autopsy #13

This week I ran a full quality audit on PC Workman — static analysis plus a custom harness that fires all 82 intents in both languages. It found 5 real defects. Two of them are the kind that make you stare at the screen for a while.

Bug one: Python 3.14 hid a broken import from me

insights.py used Optional[str] in its annotations. But it never imported Optional.

On my machine: works perfectly. Zero errors. Ships fine. On Python 3.9 through 3.13 — the versions I officially support — it crashes on import. The entire Insights module silently turns itself off.

Why did it work for me? Python 3.14 (what I develop on) added lazy annotations, PEP 749. Annotations don't get evaluated at import time anymore, so the missing import never fired on my setup. A bug that only exists on hardware you don't own is the hardest bug to see, because your machine actively hides it from you.

Bug two: my mini anti-virus accused NVIDIA and Python of being malware

The engine asks what a real analyst asks: who signed this process, is the name a fake, is it pretending to be a system process from a suspicious location.

The first version flagged my NVIDIA driver. And python.exe. As suspicious. Why? NVIDIA's driver is signed by “Microsoft Windows Hardware Compatibility Publisher,” not “NVIDIA Corporation.” My code didn't recognise the Microsoft WHCP signature and got suspicious. And Python is often unsigned entirely, which my code read as a red flag. Both flagged.

The fix was teaching the engine two real-world truths: any valid Microsoft signature means trusted, and missing a signature is not the same as being a threat. From over-zealous to zero false positives. A security tool that cries wolf gets its notifications muted in a day. Then it protects nothing.

Both bugs share a DNA: they were invisible. One because my Python version hid it, one because “unsigned” looked guilty. Neither crashed loudly. Both needed someone to actually go looking. That's the quiet reality of building solo — nobody tells you if it's a good direction, near no one points at the silent bug. You either keep auditing your own work, or things rot in the dark where nothing screams.

What's the longest a bug survived in your code because nothing ever crashed?

BuildInPublicPythonAIOpenSource
This is the project behind the post. PC Workman is a free, open-source Windows system monitor with an offline AI assistant - everything described here is real, shipped code. Download it or read the source.
← #12The Thermal Baseline That Fits in Five Contexts#14 →My AI Had a Brain — It Just Couldn't Reach It
MF

Marcin Firmuga

Solo developer · HCK_Labs · building PC Workman in public

Every edition is written from that week's real commits. Newest posts premiere on LinkedIn - the archive lives here. More about me: my story.