Kelly Mears

Defensive Default

A substituted value that papers over a missing input and hides the misconfiguration that produced it.

Method1 min read198 words9 out · 7 in
also calledFallback defaultNull coalescing default

A defensive default is a value supplied when a real one is missing, so the program can continue. Used well it is ordinary hygiene; used on identity or configuration values it is a way of converting a loud, local failure into a quiet, distant one.

The tell is whether the default can be wrong. An empty array standing in for an absent list cannot be wrong — nothing downstream misbehaves. A hostname, port, tenant identifier, API key, or feature-flag value absolutely can be, and a default silently supplies a plausible answer to a question the environment failed to answer. The environment stays broken; only the symptom moves.

Defensive defaults also distort verification. A fallback branch that is unreachable in one environment and reachable in another produces coverage numbers that differ by machine, and a test that never exercises the real path. Removing the fallback often removes the untestable branch along with it — see Unreachable Code and Branch Coverage.

A related shape is the defensive guard: a null check protecting against a state the surrounding invariant makes impossible. It reads as caution and behaves as noise, since no input can reach it and no test can cover it.

See also5

Hand-picked in the note itself — the neighbours worth reading next.

Related2

Nearby in the graph rather than deliberately chosen. Looser, sometimes surprising.

Linked from7

Notes elsewhere in the wiki that reach for this one.