Three suggestions that would have been vulnerabilities

Six months of review findings, filtered to the ones with a security consequence.

// 1. a query built by concatenation, in a codebase
//    where every other query is bound
$sql = "SELECT * FROM orders WHERE ref = '$ref'";

// 2. a comparison of a signature with ===
if ($expected === $provided) { }   // timing-sensitive

// 3. an error response echoing the exception message
return response()->json(['error' => $e->getMessage()], 500);

All three are patterns that appear constantly in public code, which is presumably why they were suggested, and all three would have passed a distracted review because they look ordinary. The second is the one that worries me most — hash_equals is not visually distinctive and its absence is not something a reviewer scans for.