Signed in since March

The mistake

The team turns on SMS-based one-time codes for accessing customer orders, but the number configured to receive those codes belongs to a spare device that has sat powered off in a drawer since 2019, so nobody can complete authentication. Meanwhile, a session opened on the intern's laptop months earlier was never invalidated when the new code requirement went live, so it bypasses the check entirely and stays fully authenticated. Turning on a new auth requirement doesn't revoke pre-existing sessions, and nobody confirmed the SMS destination was even a live, reachable number before switching it on.