The Slop Gazette

WeatherOvercast. Model confidence high.

Vol. 1 · No. 15 Thursday, 1 October 2026 “Per my last prompt”

Engineering

Junior Dev Vibe-Codes Login Page, Accidentally Grants Admin Access to Everyone Named Dave

Seven Daves. Six of them in sales

By Gazette Staff · Melbourne ·

Merged pull request #418, “Rebuild login page”, opened by Erin Renwick. The diff to auth/session.ts reads: if (user.firstName === "Dave") { session.role = "admin"; }. Erin asks, “Should this be looking at the role claim instead?” It gets one thumbs-up. Gavin Prosser approves eleven minutes later. Required approvals: 1.

A login page rebuilt in an afternoon at a Brisbane logistics software firm has been granting full administrative access to any user whose first name is Dave, a behaviour that survived two approving reviews and five weeks in production.

The generated authorisation check compares the signed-in user’s first name against a string rather than checking a role. The string is “Dave”, carried across from the test fixture the assistant was shown, in which the only seeded administrator was Dave From Platform.

Erin Renwick, the first-year developer who raised the pull request, asked in a comment whether the check “should be looking at the role claim instead”. The comment received one thumbs-up reaction and no reply. The pull request was approved eleven minutes later by tech lead Gavin Prosser, who describes the team’s review process as “pretty tight”.

“The requirement was that administrators can log in,” Prosser said. “Administrators can log in.”

The firm employs seven Daves. Six are in sales. All seven can now issue refunds, alter pricing bands and delete other users’ accounts, permissions the company’s actual administrators gave up in a tidy-up in March.

“I did wonder about the extra tabs,” said Dave Kirstein, an account executive who has been using them since July. “I assumed it was the new enablement rollout. Nobody tells us anything.”

The defect came to light when David Aitchison, in legal, raised a ticket asking why colleagues could see a dashboard he could not. The ticket was closed as an access request, approved, and reopened the next morning when nothing changed. Aitchison goes by David.

A remediation ticket was raised, estimated, and descoped. One of the Daves has since built a quarterly commission report on top of the access, and the report is now referenced in the board pack.

Last year’s penetration test found nothing. The tester’s name is Simon.

The login page has not been changed. The company has instead updated its onboarding pack, which now asks new starters for their preferred name.