I Found a $90k Remote Code Execution Vulnerability in Google

A Flask cookie on developers.google.com was signed with a secret it carried inside itself. Pulling that secret out turned a forged session into code execution across Google