← Back
App #824 · 🇬🇧 the United Kingdom
Disaster score 780Mythic
Marketing built a GDPR request tracker, ironically unsecured
☠️ No known owner🧟 Builder has left💀 Direct production access
Users22
Departments3
Criticality20%
Money involved€726,272/yr
“It's just a script.”— Kevin, Marketing
- Reason:
- Mainly because the workshop produced a Miro board with 175 sticky notes. Quietly rolled out to five countries.
- Built by:
- Kevin, the management assistant
- Build time:
- a long Thursday
- Built with:
- Google Apps Script
- Database:
- a SQL Server instance called prod-old that nobody is allowed to restart
- Authentication:
- the API key is shared with three vendors and one intern
- Deployment:
- deployed straight to production on a Tuesday, no staging
- Responsible:
- an agency acquired by another agency
- Documentation:
- a PDF exported from PowerPoint
- Security situation:
- the security exception expires every year and is renewed every year
- Future disaster:
- It will discover its own timezone policy in production.
Accidentally connected to (4)
- → depends on a shared mailbox used as an API
- → calls an internal API using the global admin token
- → scrapes the login-protected admin portal
- → calls 4 internal APIs in sequence
Age: 293 days · originally expected to last 3 months · 1 owner so far · survived 1 reorganisation · last meaningful change 3 days ago · original builder left 293 days ago
Rated mythic mostly because: €726k per year, 4 accidental connections, 3 departments depend on it.
Current owner
Nobody has taken responsibility for this disaster.
Claim responsibility