In an IM conversation, even!

Tacit: “P
Tacit: s/”/:
visudo: ‘DELETE FROM users–/g
visudo: I totally just XSS’d your substitute statement, cause you forgot the terminal slash.

Security is hard.