http://underhanded.xcott.com/ <-- a contest all about sneaking bad behavior into code without being noticed

You can't rely on a backdoor looking like this:

    if(!strcmp(username, "secretagentman")) { … }