Added a bug that would delete data from a form but only when they reopened it and didn’t paginate all the way through to the end of the form. Took ages to discover and a big job to review all the potentially missing data.

Disabled the incorrect password so that it would allow login no matter what password you use. (Original system wasn’t mine and I completely agree with “don’t roll your own security”).