Facility Services built a GDPR request tracker, ironically unsecured

“We'll add authentication later.”— Plant Manager

Reason:

Officially because the vendor quoted 10 months and one workshop. With dark mode and no error handling.

Built by:

Jens, a warehouse supervisor

Build time:

8 evenings

Built with:

a no-code builder on a personal account

Database:

a column called misc

Authentication:

TLS is enabled, certificate warnings are ignored

Deployment:

deployed through Jenkins, which has been "temporary" for 5 years

Responsible:

IT Service Desk, because their name appeared first in the meeting notes

Documentation:

a photographed whiteboard from a workshop

Security situation:

the API key is shared by 3 applications

Future disaster:

It will discover there are no backups.

Age: 241 days · originally expected to last 3 weeks · 1 owner so far · survived 1 reorganisation · last meaningful change 241 days ago

Rated common mostly because: 87% chance of becoming business critical, 27 users, alive 11x longer than intended.