Keyboard Navigation
W
A
S
D
or arrow keys · M for map · Q to exit

The Museum

37 exhibits on display

Data IntegrityAxiom

Set Theory — Membership, Boundaries, and Belonging

Every input validation bug is a set membership violation

Timeless · MathematicsAXM-001
Complexity & PerformanceAxiom

Boolean & Propositional Logic — True, False, and the Excluded Middle

Every conditional branch is a proposition. Every bug is a proof that the proposition was wrong.

Timeless · MathematicsAXM-002
Observability & OpsAxiom

Bayesian Probability — Belief, Evidence, and Updating What You Think You Know

Your test suite passed. How confident should you actually be?

Timeless · MathematicsAXM-003
Auth & AccessAxiom

Game Theory — Adversaries, Incentives, and Equilibria

SQL injection is a game. The developer chose a strategy. The attacker chose a better one.

Timeless · MathematicsAXM-004
Complexity & PerformanceAxiom

Computability & Complexity — What Machines Can and Cannot Do

Some bugs cannot be detected. This is not a limitation of your tools. It's a theorem.

Timeless · MathematicsAXM-005
Architecture & DesignAxiom

Graph Theory — Networks, Dependencies, and Paths

Every dependency tree is a directed acyclic graph. Until it isn't.

Timeless · MathematicsAXM-006
Data IntegrityAxiom

Information Theory — Encoding, Entropy, and the Limits of Communication

Every encoding bug is a violation of Shannon's channel capacity theorem

Timeless · MathematicsAXM-007
Auth & AccessAxiom

Number Theory & Cryptography — Primes, Modular Arithmetic, and the Foundations of Trust

Every HTTPS connection you've ever made depends on a theorem from 1640

Timeless · MathematicsAXM-008
Architecture & DesignAxiom

Formal Logic & Type Theory — Proofs as Programs, Types as Theorems

The Curry-Howard correspondence says every type annotation is a mathematical proof. Every type error is a theorem violation.

Timeless · MathematicsAXM-009
Injection & InputCode Flaw

The Concatenated Query

When the boundary between code and data dissolved

Late 1990s · PHP 3/4EXP-001
Complexity & PerformanceCode Flaw

The Greedy Initializer

Confusing 'application ready' with 'application loaded everything'

Early 1990s · Visual Basic 3 / VB6EXP-002
Observability & OpsDesign Flaw

The Ouroboros Health Check

When the observer became the observed's worst enemy

2010s · Go / Node.jsEXP-003
Auth & AccessDesign Flaw

The Phantom Session

When identity lived in a cookie anyone could guess

2000s · PHP 4/5EXP-004
Data IntegrityCode Flaw

The Trusting Deserializer

When the application ate whatever it was fed

2010s · Java 6/7EXP-005
Architecture & DesignDesign Flaw

The God Object

One class to rule them all, one class to bind them

1980s · C++ / DelphiEXP-006
Data IntegrityCode Flaw

The Unquoted CSV

When commas destroyed the boundary between fields

Early 1990s · Visual Basic / PerlEXP-007
Design AssumptionsRequirement Flaw

The Runaway Migration

It worked in dev. It locked prod for four hours.

2000s · SQL / RailsEXP-008
AI-Assisted EraDesign Flaw

The Autonomous Executor

When the AI did exactly what you said, and that was the problem

2020s–Now · Python / TypeScriptEXP-009
Memory & SystemsCode Flaw

The Unsynchronized Handshake

When two threads reached for the same thing at the same time

Late 1990s · Java 1.2 / C++EXP-010
Complexity & PerformanceCode Flaw

The Dead Branch

Code that compiled, deployed, and never once executed

Early 1990s · C / Visual BasicEXP-011
Memory & SystemsCode Flaw

The Overflowed Return

When the input kept writing past the end of the room

1970s · CEXP-012
Injection & InputCode Flaw

The Embedded Script

When user input became someone else's browser code

Late 1990s · JavaScript / PHPEXP-013
Auth & AccessDesign Flaw

The Forged Request

When your browser attacked you while you were logged in

2000s · HTML / PHPEXP-014
Auth & AccessDesign Flaw

The Open Door

When the only thing protecting your data was a number in the URL

2000s · PHP / JavaEXP-015
Auth & AccessCode Flaw

The Committed Secret

When the password was in the source code the whole time

2010s · Python / JavaScriptEXP-016
Data IntegrityDesign Flaw

The Poisoned Dependency

When npm install ran someone else's code before yours

2010s · JavaScript / PythonEXP-017
Injection & InputDesign Flaw

The Instructed Hallucination

When the model couldn't tell the user's data from the user's instructions

2020s–Now · Python / TypeScriptEXP-018
Data IntegrityDesign Flaw

The Hardwired Year

When two digits seemed like enough for forever

1940s–50s · COBOL / Punch CardEXP-019
Complexity & PerformanceCode Flaw

The Tangled Goto

When control flow became a maze with no map

1960s · FORTRAN / COBOLEXP-020
Memory & SystemsDesign Flaw

The Unguarded Memory

When every program could read and write everything

1960s · Assembly / FORTRANEXP-021
Complexity & PerformanceDesign Flaw

ENIAC — The First Programmers Debugged with Their Hands

When there was no line between hardware and software

1940s–50s · Physical WiringEXP-022
Data IntegrityDesign Flaw

The Dropped Deck — Why Code Has Line Numbers

When sequence was stored in the physical arrangement of atoms

1940s–50s · Punch CardEXP-023
Complexity & PerformanceDesign Flaw

SAGE — The First Software Crisis

When 250,000 lines consumed half of all programmers in America

1940s–50s · AssemblyEXP-024
Data IntegrityDesign Flaw

LEO I — The First Business Computer Bug

When automation amplified errors as effectively as efficiency

1940s–50s · Machine CodeEXP-025
Architecture & DesignDesign Flaw

Apollo Guidance Computer — The Software That Saved the Moon Landing

When error recovery by design prevented catastrophe in real time

1960s · AGC AssemblyEXP-026
Data IntegrityDesign Flaw

The Precomputed Judgment

When the senior move is to change the shape of the data, not write a longer query

Early 1990s · SQLEXP-027
Data IntegrityDesign Flaw

The Hand-Cut Partition

When the license was too expensive so you built the infrastructure yourself

Early 1990s · SQLEXP-028