The O(n^2) Bug That Looked Like Clean Code

We shipped a feature on a Tuesday. By Thursday the API was timing out. The monitoring dashboard showed p99 latency climbing from 80ms to 14 seconds over 48 hours. Nothing had changed except the number of users. The culprit was three lines of code that looked completely reasonable during review: const results = users . map ( user => { const match = permissions . find ( p => p . userId === user . id ); return { ... user , role : match ?. role ?? ' viewer ' }; }); Clean. Readable. Functional style.