The third worst security mistake - not defining what period of time temporary is
3. Temporary changes that turn out to be permanent
Under pressure to solve a problem, or just needing a quick fix to an issue: “It’s only for a short while, it won’t do any harm to relax the security”. Then the change goes in. And stays in.