A Single Transposed Letter Cost Us $4,000

I've typed import requests a thousand times. One sleepy Friday I typed reqeusts instead. My IDE didn't complain because, of course, someone had published exactly that package to PyPI. It imported fine, exposed the same surface, and for two weeks it sat in our payment reconciliation service silently logging every request body to an external server.

We found out when a customer's card processor flagged suspicious API calls from an unknown IP. The cleanup was brutal: rotate every credential that touched that service, notify affected customers, and pay for a year of credit monitoring. Four thousand dollars in incident response later, I now use pip install --require-hashes and a pre-commit hook that rejects any package not on an allowlist.

One letter. Four grand. I will never trust autocomplete again.