Is it a design or implementation flaw?