Ask HN: What are the most common security flaws in server design?

What are the most common mistakes made when creating a server with an api? For example a common mistake is logging all the request to a file and not removing the cleartext password send with the request. What are other common mistakes?