This one feels negligent. How does this go uncaught for 10 years? How did it make it into production period?

We need to re-think EVERY assumption about security.