AppSec folks: What’s your favorite “gotcha” bug to look for in code reviews? Do you have a fav bug or special bug you're great at finding? #talkappsectome 
@SheHacksPurple not sure if it can be considered a bug, but sending full stack traces to centralized log systems. It's a nefarious way to expose sensitive data in clear text without (or very few) restrictions.