request-scoped state
Keep user-specific mutable state within the request that owns it.
Use this when A warm server process reuses variables across different users.
without the term
“We had a bug where one user briefly saw another user's name. I think a variable at the top of a server file keeps the current user between requests. Can you fix this kind of leak?”
with the term · How do you ask a model for request-scoped state?
Make identity and user-specific state request-scoped. Test interleaved requests from two users for cross-request leakage.
What is request-scoped state?
Request-scoped state belongs to one request. Module-level mutable data can outlive that request and be shared with later work.
Why does request-scoped state matter when vibe coding?
A convenient global variable can leak identity or results between requests.
How do you do request-scoped state?
Pass request context explicitly. Share only safe reusable resources, and test interleaved requests for different users.
What goes wrong with request-scoped state?
A shared cache key omits the user or tenant even after globals are removed.