How a rogue script reveals a hidden flaw