You can't forget the infamous "goto fail": https://www.imperialviolet.org/2014/02/22/applebug.html https://www.imperialviolet.org/2014/02/22/applebug.html Ther

You can't forget the infamous "goto fail": https://www.imperialviolet.org/2014/02/22/applebug.html https://www.imperialviolet.org/2014/02/22/applebug.html There seems to be kind of a common theme to these: - SSL certificates not validated at all - root authentication not validated at all - JWT token creation for arbitrary Apple ID users not validated at all I think these are all very likely due to error and not malice, but it's pretty crazy how these gaping holes keep being found.