One thing we learned the hard way:

Passing tests doesn t mean your code is safe.

We had a PR that: