Yeah, it's a stupid bug. Most bugs are once you find them.

I also agree that this got into the security layer is probably the most worrisome part of the whole story. Maye this could build a case for mandatory code reviews for security related modifications.