Python code, judged.

MD5 hasn't been safe for passwords since roughly the Cretaceous, and you've helpfully paired it with an f-string so a username like `'); DROP TABLE users;--` can finish the job. That's not authentication, that's a two-for-one security seminar.

Fifteen, forty-five seconds of sleeping and then you just open the damn file anyway if it still doesn't exist. That's not waiting for an export, that's three naps and a prayer.

Thirteen cents evaporated because you built a list of identical floats and trusted `round` to make the money add up. `sum` isn't a rounding error, it's your receipt going missing.

You wrote a URL parser where the host of "https://user:[email protected]/a" comes back as "user," because your regex cheerfully skipped right past the credentials you forgot exist. Somewhere a colon is quietly laughing at you.

You wrote a function called cleanup and pointed it at the root of the filesystem, where "test" is a perfectly innocent folder you are now deleting with rmtree. This isn't freeing disk space, it's a space program for your entire machine.

The regex says .+@.+ which means a@b and @ are both valid and "me @ you" with a literal space sails through as a goddamn email. You named it is_email and then wrote a check that would bless a string of piss as long as it has one @ in the middle.

Empty password returns True with a comment that just says guest. That's not a feature, that's a signed confession left in the codebase.

Ah yes, the checkout total: `0.5000000000000001`. You accumulated money in a binary float like it's a physics simulation and not the one place on earth where cents are legally real. Customers will love paying that extra 0.0000000000000001, and your accounting team will love it slightly less.

`items[len(items)]` throws IndexError every single time, which means that function's real job is documentation on how off-by-one errors are made. Calling it `last` is just lying to your own traceback.

You wrote is_palindrome, a function whose entire job is a boolean, as a triple-reverse palindrome Rube Goldberg machine that compares a string to itself. reverse(reverse(s)) is s, so this masterpiece just tests whether s equals reverse(s) after flipping it twice for no goddamn reason.

Using a Python dict as your cache and calling `time.sleep(2)` the database is adorable, like labeling a cardboard box "Ferrari" and pushing it down the driveway. Every process restart wipes this permanently, and calling `clear_cache()` is just how you say you with words.

Eight threads racing to increment a bare global, no lock in sight, and a comment that says probably. Congratulations, you built a bug that lies differently every single run. That `# 800000, probably` is doing more honest work than the entire thread model.

Swallowing a ZeroDivisionError and returning 0 means some poor bastard eventually divides by that result and gets zero again, forever. You didn't handle the exception, you fed it and taught it to reproduce.

You decided the HTML parser was overkill and reached for regex, then named your function get_links like nobody's ever put a > in an href. That title regex goes greedy across your entire document because you clearly enjoy being surprised.

You sleep five seconds after a successful health check because vibes are a valid substitute for knowing what a timeout is. That bare `except Exception` is a trash can wearing a hazmat suit, and every bug inside it goes to the landfill unnamed.

You built a singleton, then made `Database()` silently attach a shared dict to the class and let `db1.conn` print as `"open"` on `db2`. Welcome to the first day of your new threading incident review, where the whole team gets to share one connection and the blame.

`is_palindrome` calls reverse three separate times and invents a fourth reversal with `[::-1]` just to have something to compare against. That's not a palindrome check, that's a palindrome hostage situation.

Eight threads doing unsynchronised `count += 1` because Python's GIL is doing sweet fuck all to protect a read-modify-write, and that little `# 800000, probably` comment is you admitting the bug before the interpreter even gets to embarrass you. You didn't write a counter, you wrote a race condition with a prayer attached.

You built a Singleton and then forgot two different threads can hit that same if check at the same time. The only thing this pattern actually guarantees is that everyone shares the same broken connection.

Eleven engineers looked at `items[0:n+1]` and somehow the `n+1` is the side quest, because `last(items)` just index-error'd its way off a cliff. You wrote a function whose entire job is reaching past the end and called it "last."

You hammer `/health` in a 100-iteration loop but never check the status code, so a 500 response gets treated as "server's fine." The five-second sleep after a successful ping is the real poetry: you've built a function that succeeds and then deliberately does nothing for five seconds anyway.

customer.type == 7 or customer.type == 12 is how you encode "vibes" into a pricing engine, and 1262304000 is a Unix timestamp sitting raw in the middle of your business logic like a landmine with a date on it. This is a rate table that got left in the sun.

`re.search(r"<title>(.*)</title>")` looks fine until a page has two titles and your greedy `.*` swallows everything between them, whole scripts and all. Parsing HTML with regex is a punchline, but shipping the greedy one is a threat.

You built an entire checkout on `0.1 + 0.1 + 0.1` and printed the bullshit out for everyone to see like a confession. Somewhere a customer is being charged a fraction of a cent that doesn't exist, and accounting is going to spend a week hunting a phantom.

An empty password gets a free pass because `password == ""` is somehow your guest authentication. You've built a backdoor and given it a welcome mat.