During the code review, they flagged a hypocrite commit that quietly introduced a privilege escalation vulnerability.