quarantine 'em

did I ever mention that project I worked on where I discovered we had a dedicated public API which returned the root password for one of our production servers

you could just visit the URL in your browser, no need to log in it was the least secure thing I had ever seen and earlier that release I had discovered that our private key was "cheese"

exports.authCloud = function(req, res) { var json = '{ "cloudEnv": "'+_cfg.CI_Env+'", "user": "'+_cfg.CI_user+'", "pass": "'+_cfg.CI_pass+'" }'; res.send(json); }

note how the output JSON has better whitespacing than the source code

The way this API was implemented, you could pass a URL in and one of our backend servers would make a GET request to that URL from inside our firewall