Join our Newsletter — 33% off our NHI Course
Home› FAQ› Foundations & NHI Taxonomy› Why does combining ? with undefined in a…
Foundations & NHI Taxonomy

Why does combining ? with undefined in a TypeScript property type create maintenance risk?

← Back to all FAQ
By NHI Mgmt Group Editorial Team Updated September 27, 2026 Domain: Foundations & NHI Taxonomy

Because it sends mixed signals to other developers. The optional marker suggests the property can be omitted, while undefined suggests it should still be present. That ambiguity makes code harder to reason about, weakens the self-documenting value of types, and increases the chance that callers or future maintainers use the object in incompatible ways.

Why the Combination Creates an Ambiguous Contract

Using ? together with undefined creates two different signals for the same property. The optional marker says the property may be absent, while undefined says the key exists but can hold no value. That is a small syntactic difference with a big maintenance effect: readers must infer intent instead of trusting the type to state it plainly.

In practice, that ambiguity pushes developers to ask whether the property is part of the object’s shape, part of its state, or both. A type that looks permissive can hide a stricter runtime expectation, and a type that looks strict can still allow omission. The result is less self-documenting code and more room for inconsistent usage across call sites.

That matters most in long-lived codebases, where a type is not just a compiler rule but a communication tool. When the declaration does not clearly separate “missing” from “present but empty,” maintainers may normalize one interpretation while other parts of the code rely on the other, which increases review burden and makes refactors harder to trust.

How It Breaks Reasoning About State and Usage

The maintenance risk shows up when code starts treating a property as if it were optional in some places and explicitly settable to undefined in others. Those two patterns are not always equivalent. A property that can be omitted may affect object spreading, serialization, key checks, and defaulting logic differently from a property that is present with an undefined value.

That difference becomes important when code branches on existence rather than value. For example, in checks, destructuring defaults, JSON output, and object merging can all behave differently depending on whether the key exists. If the type allows both forms without a clear reason, the implementation can drift toward accidental behavior instead of deliberate design.

It also weakens the value of TypeScript as a coordination mechanism between developers. Good types should narrow intent, not expand interpretation. When a property can be read as “may be omitted” and “may be explicitly undefined” at the same time, the type no longer helps the team converge on one usage pattern.

In larger systems, that often leads to quiet inconsistency rather than immediate breakage. One module may write the property only when known, another may always include the key, and a third may assume either form is acceptable. The code still compiles, but the contract is no longer stable enough to serve as a reliable boundary.

What Good Type Design Usually Looks Like Instead

The safer choice is to encode one meaning, not both, unless the distinction is genuinely required by the domain. If the property is truly optional, use the optional marker and let absence carry the meaning. If the property must always exist but may intentionally hold no value, include undefined without making it optional so that the object shape stays consistent.

That separation makes the contract easier to test and easier to read. It also helps tooling, because developers can see whether they should check for presence, handle a deliberate empty state, or both. In code review, the question becomes “does this property belong on the object?” rather than “which of two similar meanings did the author intend?”

For APIs and shared models, the distinction matters even more because ambiguity tends to spread. A loose type in one package becomes a loose assumption in every consumer, and then the object shape is preserved by habit rather than design. Clearer declarations reduce that drift and make future changes less risky.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP ASVS and NIST SP 800-53 Rev 5 set the technical controls, while ISO/IEC 27001:2022 defines the regulatory obligations.

FrameworkControl / ReferenceRelevance
OWASP ASVSV15 — Secure Coding and ArchitectureClear type contracts support maintainable application design and reduce ambiguous state handling.
Recommendation — Model optional and undefined states distinctly so code intent stays unambiguous across callers.
NIST SP 800-53 Rev 5SA-11 — Developer Testing and EvaluationAmbiguous property contracts increase defect risk in code verification and review.
Recommendation — Verify that type definitions express one clear state model before merging shared code.
ISO/IEC 27001:2022A.8.25 — Secure development life cycleType ambiguity is a secure-development quality issue that can persist through maintenance.
Recommendation — Enforce clear coding conventions that prevent ambiguous optional and undefined property semantics.

Practitioner Guidance

What to verify: Decide whether the property’s absence and its undefined value are genuinely different states. If they are not, do not model both. If they are, document which downstream code should check presence versus value.

Common mistake: Treating ? plus undefined as harmless redundancy. In shared code, redundancy often becomes ambiguity, and ambiguity becomes inconsistent usage.

Decision rule: Use the simplest type that matches the object contract. Prefer one clear meaning per property, and only keep both forms when the runtime behavior really depends on the difference.

Practitioner takeaway: The maintenance risk is not the syntax itself, it is the mixed contract. If the type does not force one interpretation, every maintainer has to re-infer the intended state model, and that is where drift begins.

Deepen Your Knowledge

Sign up to our weekly newsletter — get 33% off our NHI Foundation Level Course

    NHIMG Editorial Note
    Reviewed and updated by the NHIMG editorial team on September 27, 2026.
    NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org