There was a story on HN recently about a security breach on some website because of a hand written auth scheme. I was surprised with how many people just thought it was normal to hand roll auth stuff. I think it comes mostly from the server side JS crew but it is definitely disturbing the amount of wheels being reinvented out there