Missing One Line of Code Locked Government Staff Out of Critical Services

A developer on a government authentication engineering team discovered a subtle bug during the rollout of Multi-Factor Authentication across state service centres. The flaw caused a small subset of users — those navigating with a keyboard rather than a mouse — to receive a server error when attempting to log in. Affected staff were unable to process driver's licence applications, register vital events, or access disaster relief systems. Despite extensive testing before launch, the root cause turned out to be a single missing line of JavaScript: e.preventDefault(), which prevented the browser from bypassing the React app's authentication flow. The bug was only identified after engineers visited a service centre in person and observed users interacting with the application directly.