I accidentally built a bot whose only job was to attack our own GitHub

Short summary

A developer describes how bidirectional GitHub-to-app sync created an infinite feedback loop where each system bounced changes back and forth endlessly. The fix: flag synced changes with a dict to prevent re-syncing them, and use resolver_id=None to mark system-triggered changes so activity logs stay accurate. This simple pattern prevents dedicated self-inflicted API attacks in production.

• •Bidirectional syncs between systems can create feedback loops where changes loop infinitely
• •Solution: flag synced changes to prevent re-sync, mark system changes with null resolver_id
• •This pattern applies to any two-way integration—GitHub, Slack, databases, CRMs, etc.

Generated with AI, which can make mistakes.