How do I add bugs that only affect one user and make it look like an accident?

Weird binary magic and requirements like browserversion, locally installed libs and bugs.

if uid == <user-id>:
misbehave()

Also buffer overflow.

@Lor-inc , I haven't done this before 🤐

@C0D4 I only did categorical ones, eg. users registered with a freemail email account (a terrible local provider that occasionally makes room by deleting archives or accounts altogether) had a lower priority on all account related operations, and IE users got a separate "compatibility" CSS file that was pretty much empty except for a minimal layout. (I still often do that, once supporting a browser becomes a hassle I add it to compatibility mode.

😂

User with non visible character data...

Add eg to the login name tabs / non printable character data

Most people don't sanitize / validate input

@rutee07 rofl

Obfuscated indirection. Create an corner case, add a few methods that make sense, but don't account for the corner. Ensure that the user's account hits that corner case. If possible make it somewhat random so it's difficult to replicate even with the user's data. Personal favorite of mine is to rely on some particular encoding that enables targeting via mostly unique combinatorials across n functions (usr prefixing, role targetting, generic attribute extensions, etc).

Sadly it's not active anymore, but maybe you can get ideas ;-)

http://www.underhanded-c.org/

What i do is set their account to go to testing instances and screw shit up there for them