[sowbug]

It's scary when a company ships a security feature with a buggy "happy path," because it generally means the engineers who built it don't follow personal best security practices themselves.

An example is whether a website's login form works with browser autofill. If it doesn't, it probably means the person who built that page doesn't use browser autofill, which means they probably use the same password on all their personal accounts, which is terrifying. (Bad example for a product that's supposed to replace the browser's built-in password manager, but you get the idea.)