Things such as file download and upload, custom session management, authorization and access control, homegrown single sign-on, password storage and reset mechanisms, email functionality and search functionality often have critical flaws because of the subtle complexity required to implement them safely.