Much of the time, issues in security or encryption pop up from the endless creativity of humans. Has the developer considered what to do if an entire password string is all emoji? Can they handle the entire CJK (Chinese, Japanese, Korean) set of inputs? (if they're international, anyway.) What about diacritics? If symbols throw the program for a loop, that will need debugging.

Were some test credentials hardcoded into the program that give admin access? That's a big security risk.