(Or, "Code expires in 3 days" was implemented incorrectly, and there's a security bounty opportunity in reporting it!)