Password app had major flaw