We spent several days rebuilding 1lan, our reverse-tunnel service, so that each machine gets an allocated endpoint instead of one derived from its own IP address. The rebuild went fine. What was interesting was the bugs.

Seven of them, and they turned out to be the same bug wearing different clothes: a check that reports success while the thing it checks is absent. Not a control that fails loudly. A control that passes, logs nothing, and protects nothing.