I work for a company with a similar sort of online ordering API, and a while back some enterprising person discovered that: 1. Our API had a hidden "tip" featu

I work for a company with a similar sort of online ordering API, and a while back some enterprising person discovered that: 1. Our API had a hidden "tip" feature; we hadn't exposed it in the storefront yet, mostly because the developer in charge of it had left with it halfway finished, and nobody had picked it back up yet 2. But the API itself was perfectly functional. If you manually submitted an order to the API with a tip set, it would be reflected in the total, would bill your credit card, etc. 3. Except (I'm sure you saw where this is going...) the now-departed dev hadn't added any validation yet. So if you ordered $40 worth of pizza and added a negative $39 tip...boom, nearly free pizza. We learned a few valuable lessons for the cost of buying a college student a couple of pizzas. :)