Data Protection built a brand asset request portal

“It has HTTPS.”— Head of Operations

Reason:

Allegedly because the printer is somehow involved. Renamed three times to avoid attention.

Built by:

Sofia, an intern

Build time:

43 minutes

Built with:

WordPress with eleven plugins and one critical shortcode

Database:

one table with 260 columns

Authentication:

Basic Auth over plain HTTP

Deployment:

hosted in a cloud region nobody intended to use

Responsible:

whoever answers the support email

Documentation:

a Word document with tracked changes still enabled

Security situation:

the audit log also contains passwords

Future disaster:

It will get backups after the first data loss.

Age: 8.9 years · originally expected to last 3 months · 5 owners so far · survived 2 reorganisations · last meaningful change 420 days ago

Rated common mostly because: 370 users, alive 36x longer than intended, older than the department using it.