A programming footgun is a feature, API, default, or command that makes it unusually easy to cause serious harm by mistake. It may work exactly as documented; the problem is that the unsafe outcome is too easy to reach, while the safer option requires extra knowledge or care.
What makes something a footgun?
The PHP Dictionary defines a footgun as “a feature or a piece of code that makes it easy to unintentionally shoot oneself in the foot.” In practice, the term describes a design risk, not necessarily a software defect: the behavior can be intentional and documented, yet still invite bugs, security gaps, or data loss.
A useful test is whether a tired or inexperienced person can reach a high-impact failure through the obvious or default workflow, while avoiding it requires special knowledge or vigilance. A surprising interface with little consequence is usually just a gotcha or sharp edge; severity and likelihood make a footgun more consequential.
Common programming footguns
These examples are legitimate tools or language features. Their risk comes from how readily ordinary use can produce an unintended consequence.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11| Example | Why it can be a footgun | Safer practice |
|---|---|---|
C’s strcpy |
It copies a string without checking that the destination buffer has enough space, which can lead to memory corruption. | Use bounded, validated copying and ensure the destination capacity is handled correctly. |
JavaScript’s == |
It performs implicit type coercion, so comparisons can produce results that are surprising if types differ. | Prefer === when strict equality is intended, and validate or convert values explicitly. |
| Python mutable default arguments | A mutable default object can be reused across function calls, allowing state to persist when a caller may expect a fresh value. | Use None as the default and create a new mutable object inside the function. |
Git push --force |
It can overwrite remote branch history, affecting other contributors and making work harder to recover. | Check the target branch and coordinate before rewriting shared history; use a safer, explicitly reviewed workflow where appropriate. |
Shell deletion with rm -rf |
If a variable or path unexpectedly expands to an empty or overly broad value, a destructive command may remove the wrong files. | Validate paths and variables before deletion, quote expansions, and preview targets before running irreversible commands. |
Security footguns can also arise when an API is so flexible that it is easy to use it in an unintended, unsafe way. Include Security describes this pattern and reports a Semgrep rule intended to detect it; its example illustrates why convenience should not replace constraints in security-sensitive interfaces.
Why footguns are a design problem
A footgun can turn a routine workflow into an outage, overwritten data, code injection, a privilege mistake, or a difficult-to-reverse change to repository history. Because the action may appear normal, users may not recognize the risk until damage has occurred.
The term also points to responsibility beyond the person who made the mistake. If competent users repeatedly take the same harmful path, the default, naming, documentation, or guardrails may need to change. Training helps, but it is weaker than making the safe path the natural path.
How to prevent footguns
Make safe behavior the default
OWASP’s secure-by-default guidance says the default configuration should use the most secure settings possible. Restrict functionality to what is necessary, and explicitly limit unnecessary functions, ports, protocols, and services. Apply this principle to software interfaces too: avoid defaults that expose broad permissions or enable destructive behavior without a clear need.
Rank #3
Constrain inputs and capabilities
Prefer APIs that express a specific, limited operation over unconstrained calls that can “do anything.” Use types, validation, and permissions scoped to the minimum required. Clear names and documentation should make side effects visible rather than relying on users to infer them.
Add friction where mistakes are costly
Use dry-run or preview modes to show what a command will affect. Require explicit confirmation for destructive operations, and provide rollback or recovery mechanisms when possible. The amount of friction should match the potential blast radius: a reversible local change does not need the same safeguards as deleting production data.
Check for risks throughout development
NIST’s security engineering guidance connects customer needs and protection requirements to documentation, design, synthesis, and validation. This gives teams opportunities to identify dangerous defaults early and verify that safer workflows are still usable. Linting, static analysis, code review focused on irreversible actions, and runbooks for recovery can reinforce those safeguards.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to assess a potential footgun
When reviewing a command, API, or language feature, assess the risk along these dimensions:
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Best Value
- Severity and blast radius: How much data, service availability, or access could be affected?
- Likelihood: Is the unsafe outcome plausible during ordinary use?
- Default behavior: Does the easiest path enable the dangerous action?
- Reversibility: Can the change be undone, and is recovery practical?
- Clarity: Do the name and documentation make side effects apparent?
- Guardrails: Are permissions, previews, confirmations, or automated checks available?
The higher the impact and likelihood, the more important it is to change the default or add a guardrail instead of relying on users to remember a warning.
Where the term comes from
“Footgun” is established programming slang based on the metaphor of accidentally shooting oneself in the foot. The available references do not establish a definitive first-use date or a single inventor, so a more specific origin claim would be uncertain.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
