A bank account that never existed shipped to production
The details were invented for a mockup and walked straight through. A user found them before I did.
Early on I needed a payments page to look finished, so I typed bank details into it. A bank name, an account number, none of it real. It was a mockup and I knew it was a mockup.
The mockup became the page. The page shipped. The details walked through every review that release got, mine included, because by then I had looked at them so many times they read as part of the layout rather than as content.
A user told me. They were trying to pay.
Deleted the same day. Before a release goes out now I grep for the whole family of placeholder strings: that account number, lorem, the test email address, localhost, TODO in anything user facing. It takes a second.