You think this is funny, but a codebase I once inherited did exactly this. Up until that point in my life, I never imagined I’d ever have such a violent urge to strangle someone.

Bonus: the system had two types of accounts for signups: one for employers and one for employees. Naturally, it would set the role of the created account during the signup process, but the issue was that anyone could submit a signup request with a custom payload and set themselves as the third account type: administrator.

Bonus #2: during a self-update request (avatar change, etc), users were able to change their own IDs in the database.

It was 100% vibe-coded by two imbeciles in two months. We had to rebuild 80% of that codebase.

So have you hacked into starboy98's mainframe yet?

I once worked a place that required me to have access to a very confidential database. To "protect against hackers", they changed the (collective) password every week and sent me the new one in open text to my webmail account. 😳

TAP
TAP
TAP
"I'm in."

Not the same but I ordered some electronics from a local store recently and the "forgot your password" link sent me a mail with my password.