the security bug was a lack of authentication that rendered Dropbox nearly useless for its core purpose of securely storing files, that got pushed to production and _stayed there for multiple hours_.

giving Dropbox some guff for it is completely reasonable.