When /pair approve Bypasses the Scope Guard

There's a particular class of security bug that I find endlessly fascinating: the one where two paths...