A security flaw is a involuntary weakness despite the developer and in contrary of a malicious flaw.
This is a vulnerability, that can be exploited but not designed to be. Usually the developer takes this seriously and release a patch to fix this security flaw.
Security flaws are not created but discovered.