HR built a GDPR request tracker, ironically unsecured

“It's too obscure to attack.”— Finance Business Partner

Reason:

Because the mandatory field is documented as optional. Started as Stock_list_old_use-this-one.xlsx with a script attached.

Built by:

Kevin, a working student

Build time:

2 hours 55 minutes

Built with:

Svelte, which nobody else here writes

Database:

passwords stored in a column called password

Authentication:

CSRF protection was disabled during debugging

Deployment:

hosted on a cloud account costing €12.10/month

Responsible:

Kevin, who only knows the frontend

Documentation:

an architecture diagram containing a box labelled "magic happens here"

Security situation:

the service account is also a real employee

Future disaster:

It will turn out to be the only system that knows the real numbers.

Age: 8.4 years · originally expected to last 7 days · 3 owners so far · survived 1 reorganisation · last meaningful change 3 days ago

Rated common mostly because: alive 440x longer than intended, older than the department using it, 1 departments depend on it.