Why this matters
The bug. JavaScript's + is overloaded: number + number adds, but if *either* side is a string, both sides get coerced to strings and the operator concatenates. total starts as 0 (number) but flips to "05" after the first iteration; from that point every value is appended as text.
The fix. Coerce explicitly at the boundary: Number(v), +v, or parseInt(v, 10) for whole numbers. The unary + is the most idiomatic but the least obvious to readers; Number() reads better.
Heuristic. Whenever data crosses a wire — HTTP forms, query strings, localStorage, JSON.parse of untyped objects — assume strings. Coerce on entry, not at the use site.
Review heuristic
Hunt the diff for implicit conversions: bare + between unknown types, == instead of ===, JS truthiness checks where a strict null-check was meant. Each one is an opportunity for the language to do something the author didn't intend.