Operations built a commission calculator with a rounding bug

“The data isn't that sensitive.”— Anja, Operations

Reason:

Allegedly because the vendor said it could be ready in Q1, assuming requirements do not change. Quietly rolled out to five countries.

Built by:

Anja, a controller

Build time:

an afternoon, mostly

Built with:

a Rails app from 2016 nobody updated

Database:

Firebase with open read rules since September

Authentication:

IP allow-list containing 0.0.0.0/0

Deployment:

on the marketing website's server, somehow

Responsible:

an intern whose contract ended in March

Documentation:

a diagram on a whiteboard, photographed, then deleted

Security situation:

the data protection officer does not know it exists

Future disaster:

It will outlive two reorganisations.

Age: 70 days · originally expected to last 3 months · 2 owners so far · survived 1 reorganisation · last meaningful change 70 days ago · original builder left 49 days ago

Rated common mostly because: €77k per year, 3 departments depend on it, the builder has left.