Stupid programming mistake, or intentional backdoor?