The worst bug (or bad design if you wish) I've seen in confluence is the following - permissions on pages are inherited in a tree-like manner, parent to child.

The worst bug (or bad design if you wish) I've seen in confluence is the following - permissions on pages are inherited in a tree-like manner, parent to child. A reindex wasn't done and at some point child pages with sensitive information became viewable to every user because the permissions were not re-applied. I would absolutely never rely on the permissions in Confluence to store anything sensitive in it ever again.