What was the worst bug you've ever solved ?
tlb: At Viaweb, my careless use of $_ in Perl led to the name of every credit card shown in the merchant UI being replaced by a secret auth key. I didn't see it because that particular auth check was bypassed for admin users like me. It wasn't a serious security hole, and we changed the auth key afterwards. But as it happened, I was in a cranky mood when I created the auth key and it had some bad words in it, so it was a little embarrassing.