I mean just a couple days ago on the front page we read about a Paypal multifactor bypass by.... Wait for it... Deleting the token field from the post request.

I mean just a couple days ago on the front page we read about a Paypal multifactor bypass by.... Wait for it... Deleting the token field from the post request. Vulnerabilities are often trivial in hindsight and lost in a massive forest up until the moment they are serendipitously discovered. I'm not saying a proper audit shouldn't have found this and flagged it. But yes, agree strongly, vulnerabilities can be surprisingly hard to find.