Weak password storage, exposed session tokens, missing multi-factor authentication. These are classic developer security ...