Moments like these are why my co-workers settle in to read my trouble tickets with amusement:

There are notes in the code that specifically indicate the maintainer hasn't written all of the security-related code yet.  (Um.  WHAT?)  The integration issues wouldn't grind our server to a halt if the module actually was respecting access permissions, because then the errors would only be happening for about 3 users.  This simply isn't acceptable, so I've disabled the integration until I can get a better handle on what's going on with this module.  Or stalk the maintainer.  Whichever.

...and that's just one ticket.  It's not even 9:30 yet.  I'm thinking it's going to be a banner trouble ticket day.