passwords for products had a bug