Devs sent into security panic by 'feature that was helpful until it wasn't'