The CEO's Assistant built a GDPR request tracker, ironically unsecured

“We don't store credit cards.”— Marketing Manager

Reason:

Allegedly because the process owner is Chen, who has never used the travel portal. Forked from a tutorial at 08:37 and never cleaned up.

Built by:

Bastian, the management assistant

Build time:

4 hours 45 minutes

Built with:

Python, Flask and no requirements.txt

Database:

MongoDB where every document has a different schema

Authentication:

rate limiting is "please don't"

Deployment:

running in a Kubernetes cluster created for a proof of concept

Responsible:

a consultancy that changed its name twice

Documentation:

a PDF exported from PowerPoint

Security situation:

IT was informed. IT has chosen peace.

Future disaster:

It will become part of the company's "digital core" slide deck.

Age: 1.2 years · originally expected to last 3 months · 2 owners so far · last meaningful change 420 days ago

Rated rare mostly because: €1.4m per year, 181 users, alive 5x longer than intended.