Facilities built a GDPR request tracker, ironically unsecured

“We didn't have time for a ticket.”— HR Generalist

Reason:

Allegedly because Leads_old.csv finally crashed at 09:59. Renamed three times to avoid attention.

Built by:

Olivier, a recruiter

Build time:

one weekend

Built with:

Power Apps, licensed to one employee

Database:

filenames. The filenames are the database.

Authentication:

permissions are checked by asking "should this person be here?"

Deployment:

last successfully deployed 317 days ago

Responsible:

an external agency with no contract on file

Documentation:

a Loom video nobody can find

Security situation:

rate limiting consists of hoping nobody notices

Future disaster:

It will make an audit take 3 extra weeks.

Age: 1.7 years · originally expected to last 3 weeks · 2 owners so far · last meaningful change 210 days ago · original builder left 253 days ago

Rated rare mostly because: 215 users, €45k per year, alive 29x longer than intended.