You think this is funny, but a codebase I once inherited did exactly this. Up until that point in my life, I never imagined I’d ever have such a violent urge to strangle someone.

Bonus: the system had two types of accounts for signups: one for employers and one for employees. Naturally, it would set the role of the created account during the signup process, but the issue was that anyone could submit a signup request with a custom payload and set themselves as the third account type: administrator.

Bonus #2: during a self-update request (avatar change, etc), users were able to change their own IDs in the database.

It was 100% vibe-coded by two imbeciles in two months. We had to rebuild 80% of that codebase.