A common sign is code that declares a property as optional to satisfy the compiler, then accesses it everywhere as if it were always present. Another clue is a type that includes both ? and undefined, which often indicates uncertainty about whether the property is truly optional or merely nullable. Both patterns increase confusion and runtime error risk.
How optional properties get misused in practice
Optional TypeScript properties are meant to express that a value may legitimately be absent, not to act as a workaround for uncertain data modelling. Misuse usually shows up when the codebase stops treating the property as optional and starts treating it as effectively mandatory. That gap between the declared type and the actual usage is where the bug pattern lives.
The clearest symptom is a property that is marked optional, then immediately read in the same code path without any narrowing, fallback, or guard. In practice, that means the compiler is being asked to tolerate a design problem rather than the design being adjusted to reflect the real shape of the data.
Type signals that the model is fighting itself
A second sign is a type definition that mixes optional properties with undefined in a way that does not answer a real semantic question. If the property is truly optional, the code should say so consistently. If it can exist but be empty, or if it is conditionally populated, the model should reflect that distinction explicitly instead of layering both forms together.
Another warning sign is that downstream code starts adding defensive checks everywhere because the type no longer communicates a stable contract. At that point, the optional marker is no longer simplifying the design, it is hiding uncertainty that should have been resolved earlier in the interface or object model.
When this pattern spreads, optionality becomes a tax on every consumer. Instead of using the type to document intent, engineers begin using runtime assumptions, ad hoc casting, or repetitive null checks to compensate for a model that does not match behaviour.
What the misuse looks like in a codebase
Misuse often clusters in a few places: request payloads that are typed loosely, configuration objects where defaults are unclear, and domain objects whose lifecycle is not well defined. A property may be optional in one layer because data arrives incrementally, but if every later layer assumes it exists, the optionality is no longer describing reality.
It is also common to see optional properties used to suppress compiler friction during migration. That can be acceptable temporarily, but it becomes a smell when the optional flag remains after the data flow is already stable. In that case, the type has outlived its purpose and now obscures whether absence is valid, exceptional, or simply unimplemented.
At a language level, the problem is not the ? itself. The problem is that ? is being used to avoid deciding between three different states: missing, present with a value, or present with an explicit empty value. Once those states are collapsed, the code usually becomes harder to reason about and easier to break.
Practitioner Guidance
What to verify: Check whether the property can genuinely be absent across its full lifecycle, or whether it is always expected after initialization. If the answer is “always expected,” make the type required and push the defaulting or construction logic earlier.
Decision rule: If callers must immediately guard every access, the property probably is not serving as a useful optional field. If absence is part of the business meaning, keep the optional form but document the rule at the boundary where the object is created or validated.
Common mistake: Do not use optionality as a temporary escape hatch for incomplete modelling and leave it there indefinitely. That turns type checking into a suggestion instead of a contract and usually shifts errors from compile time to runtime.
Practitioner takeaway: A well-modelled optional property should reduce uncertainty for readers and callers. If it increases checks, casts, or confusion, the type is telling you the design still needs to be clarified.
Related resources from NHI Mgmt Group
- What are the signs that a SOC report is not giving executives a true view of security posture?
- What are the signs that a privacy framework is becoming operational rather than theoretical?
- What are the signs that traditional PAM is leaving too much risk in place?
- What are the signs that customer data controls are failing in a support centre?
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on September 27, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
