Ask HN: What is the most common security mistake you see?

Mainly I'm asking about websites, but other security mistakes are welcome (e.g., IoT, apps, firmware)

Also acceptable: Not common but happens reasonably often and exposes large vulnerabilities.