OK that is pretty interesting. For the TL;DR crowd, the exploit was:
if(environmentǃ=ENV_PROD){
// bypass authZ checks in DEV
return true;
}
where the 'ǃ' is a Unicode homoglyph (U+1C3 "LATIN LETTER ALVEOLAR CLICK") which obviously completely changes the nature of the code.
I'll note that GCC gives a clear warning here ("suggest parentheses around assignment used as truth value"), so as always, turn on -Werror and take warnings seriously!
