Where do all of you keep finding those companies? Is that an SV thing, or am I just not applying to "prestigious" enough companies? I've been on my fair share of interviews and haven't had that happen once, along with no whiteboard interviews. I can echo your experience about Github projects playing a small role apart from signaling though. Once, an interviewer mentioned one of the Github projects I worked on and we exchanged 2-3 sentences about it, but I don't think it had a significant impact on the result of the interview.

As a rule, I don't and have never consented to them because I find them exploitative.

- Long home coding challenge (for no pay of course) - Hours of whiteboard coding talk. If you're lucky it relates to the job at hand, most of the time it doesn't - Doing coding tests online, either through their propitiatory app or through sites like HackerRank. - A conversation type interview, where you talk about the job (have only had this one in my recent attempt. Didn't get past that phase)

Of the roughly 30 interviews that I've done in the last ten weeks, only one place ever asked about my github profile (which I don't have yet, currently revamping it since most of the code was years old and pretty meh). Almost every one of them had questions about my linkedin profile though.

There is a way to do this. But some people go a little too far.

Last years one start up asked me to write an entire backend application for them for free.

That they declared bankruptcy this year has been a tasty bit of schadenfreude.

Nothing to do with prestige, it's a simple "will this monkey jump through hoops" test to see if you'll work in shitty conditions for shitty pay.

My go to response is asking them to look at my git instead, which ends the process in about half the cases. The other half they look at it for <5 minutes and point out the error that isn't an error (yes I know what an SQL injection is, and I've taken steps to make sure it won't be an issue).

I'm not sure where I'd put the comment, since in the part where router paths are set up, it's self-documenting/obvious that it isn't an issue, and if the person skips that and looks at individual functions only, then I'd have to put it in too many places.

Another option is to create a function like _escape_numeric_string that returns its input after asserting the string is numeric and has a comment explaining, and use it everywhere. Although yes, that does mean changing all your individual functions.

Generally if a code reviewer suggests a change it is worth documenting why the change isn't practical. That can be adding a test or adding a comment.