@fluepke my favourite example of this was a platform with web/android/iOS apps, where signing up with a password containing diacritics or emojis would let you log in, but if you switched apps it wouldn't let you log in because the complexity check got re-ran on login (it was a shared component). for some passwords you could have one app approve the length, but another reject it. for other passwords you could have one app approve the complexity requirements, but another rejected it. wacky.