Streamlit

A gated app shows its login screen to everyone and its actual product to almost nobody. Putting a live sample on that screen took a few lines — and immediately exposed a CDN that had been failing silently for anyone whose network was not mine.

A successful Google sign-in proves someone owns a Google account — not that they may use your app. Without an allowlist the page is open to everyone, and a new OAuth client answers every sign-in with 403 until the consent screen is dealt with.

A Streamlit invoice generator downloaded NanumGothic on first use and silently fell back to Helvetica when that failed. Helvetica has no Hangul — and no won sign either, which broke English invoices too.