Resetting a password changed the hash but left every existing session valid, including the attacker's. We traced why, added session versioning tied to credentials, and made password changes, MFA changes and admin actions end other sessions.
After a mobile release, customers who changed their delivery phone number lost their saved address notes and opening hours. The app was sending a partial body with PUT, and the API did exactly what PUT means. The fix: PATCH with JSON Merge Patch, and a PUT that rejects partial bodies.
A partner reused one idempotency key for two different charges. Our API matched the key, replayed the first response and reported success for a payment that never happened. We now store a fingerprint of the request, reject mismatches with 422 and scope keys properly.