Corporate Security built a data processing agreement tracker

“It only writes when necessary.”— Plant Manager

Reason:

Honestly? Because the backlog contains 11,670 items and one priority. Built during an offsite instead of the thing they were asked to build.

Built by:

Elena, a product owner

Build time:

3 evenings

Built with:

a no-code builder on a personal account

Database:

two databases kept "mostly in sync"

Authentication:

a login screen that accepts any password

Deployment:

deployed through Jenkins, which has been "temporary" for 3 years

Responsible:

Daniel, who only knows the frontend

Documentation:

an email chain containing the phrase "see below" 13 times

Security situation:

production secrets are in the frontend bundle

Future disaster:

It will send 113,751 duplicate emails.

Age: 7.3 years · originally expected to last 4 weeks · 4 owners so far · survived 2 reorganisations · last meaningful change 19 days ago

Rated common mostly because: alive 89x longer than intended, 28% chance of becoming business critical, older than the department using it.