32 years of security, and I can't say one has passed without someone saying "in retrospect, [the bug] was obvious" about *something* — so you're in good company. :-)