If a user wants a feature, the feature request is a low priority, but the user finds and exploits a bug allowing to get to the same result as if the feature was present, what should I do as a developer ? Should I fix the bug (and lose a “feature”) ?
Note : the bug is not a security threat, nor a data integrity threat.
Scenario #2 : We don’t know if users are using the exploit as a “feature”. Same question.
Well, this is more a question of personal preference rather than coding but…
If people were known to be using the bug/feature AND assuming we are 100% sure that the bug is not a security threat, I would leave it there until such a time as I could implement the feature properly.
I would not want to risk putting users off using a service (even if it meant they had to temporarily use a bug to do what they wanted).
However, if you thought no one was using the bug OR that it may me a security threat, I would fix it.