I quickly found the first bug that shocked me, this bug was based on code that performed a user login check but did so using cookies or PHP session variables.

source: grugq