Scan — the grader in the Sentinel suite — makes outbound requests to whatever host you type in. That’s an obvious hazard, so I wrote a guard early: resolve the hostname, check every address it returns, refuse anything in a private, loopback, or reserved range. Including the cloud metadata address, which is the one that matters most when you run on someone else’s infrastructure.
I tested that guard properly. It blocks loopback, the private ranges, IPv6 loopback, DNS-resolved localhost, and the metadata endpoint. Every test passed. The guard was correct.
Months later, auditing it for a different weakness, I read the code around it instead of the code itself.
The guard ran once, at the top, against the host you typed. The headers check then walked the redirect chain by hand, fetching each hop in turn. There was no guard anywhere in that loop.
So the hole was this: a domain on a public IP passes the guard, then answers with a redirect pointing at an internal address. Scan follows the redirect, because following redirects is what the headers check does, and now it has made a request the guard exists specifically to prevent. No DNS trickery, no race. Just a redirect, walking straight through a guard I had verified worked.
The guard was never wrong. Every assertion I had made about it was true. The mistake was in where I called it, and no amount of testing the guard in isolation could have surfaced that, because the guard was not the thing that was broken. The boundary I had drawn around it was.
The fix guards every hop and pins each verified address through to the connection, so the address I checked is the address I actually reach. But the more useful thing I took from it is the shape of the mistake. I had a correct component with good tests and a hole around it. My testing had been aimed at the component the whole time, and the bug was never in the component.
Testing a component in isolation cannot reveal a scoping error. The bug is not always in the thing you are looking at. Sometimes it is in where you decided to stop looking.