Most mistakes are basic, but they come about because people don't test their code/sites with the mindset of an attacker. This is pretty much always the case wh

Most mistakes are basic, but they come about because people don't test their code/sites with the mindset of an attacker. This is pretty much always the case when it comes to XSS, and SQL-Injection attacks. There are lots of words written about security, so it's hard to pick a single thing. But my vote would be for "enumerating badness", and "default permit", which are kinda related.