So there's two kinds of problems here - not all security flaws are created equal. One kind is missing something or unintended consequences. Making all URLs cli

So there's two kinds of problems here - not all security flaws are created equal. One kind is missing something or unintended consequences. Making all URLs clickable opens a UNC attack due to some obscure Windows "feature", for example. Or having N digit numbers means they're technically iterable, but this is the same for cellphones, and there are workarounds. The other kind is security holes caused by explicitly working to bypass security restrictions yourself. Installing a server with webcam permissions that you don't cleanup so reinstallation is easier for you (don't be surprised when other apps start telling it to switch on the webcam), impersonating the system root password dialog (don't act surprised when other apps steal the password from you), claiming end to end encryption without being clear about where and when it's on, and others. The first is normal security work, the second is sleazy. We all forgive the first, but we shouldn't let sleaziness slide.