CEO's Daughter built a GDPR request tracker, ironically unsecured

“We only need it for this quarter.”— Jens, CEO's Daughter

Reason:

Mainly because the CEO asked for it in a corridor on a Monday. Built during an offsite instead of the thing they were asked to build.

Built by:

Jens, a warehouse supervisor

Build time:

an afternoon, mostly

Built with:

a Rails app from 2016 nobody updated

Database:

a network drive mapped as Z: on three people's computers

Authentication:

the password is stored in a spreadsheet called passwords.xlsx

Deployment:

running on a development server labelled DO NOT RESTART

Responsible:

a former employee still helping occasionally

Documentation:

a Confluence page marked "draft", last edited 11 days ago

Security situation:

production secrets are in the README

Future disaster:

It will get monitoring after the first outage.

Age: 4.5 years · originally expected to last 7 days · 1 owner so far · survived 2 reorganisations · last meaningful change 19 days ago

Rated common mostly because: 83% chance of becoming business critical, 91 users, alive 237x longer than intended.