Six months of review findings, filtered to the ones with a security consequence.
// 1. a query built by concatenation, in a codebase
// where every other query is bound
$sql = "SELECT * FROM orders WHERE ref = '$ref'";
// 2. a comparison of a signature with ===
if ($expected === $provided) { } // timing-sensitive
// 3. an error response echoing the exception message
return response()->json(['error' => $e->getMessage()], 500);
All three are patterns that appear constantly in public code, which is presumably why they were suggested, and all three would have passed a distracted review because they look ordinary. The second is the one that worries me most — hash_equals is not visually distinctive and its absence is not something a reviewer scans for.