Quality Assurance built a GDPR request tracker, ironically unsecured

“We'll clean it up after the audit.”— Miriam, Quality Assurance

Reason:

Officially because the optional field breaks everything if left empty. With 16 users and 36 feature requests.

Built by:

Miriam, an analyst

Build time:

an afternoon, mostly

Built with:

an AI agent with shell access

Database:

a table called temp that has existed for 3 years

Authentication:

JWT validation checks that the token looks like a JWT

Deployment:

on the marketing website's server, somehow

Responsible:

whoever still has the admin password

Documentation:

a Miro board that takes 4 minutes to load

Security situation:

the penetration test found it by accident

Future disaster:

It will become a works council agenda item.

Age: 293 days · originally expected to last 7 days · 1 owner so far · survived 1 reorganisation · last meaningful change 3 days ago

Rated common mostly because: €193k per year, 33% chance of becoming business critical, alive 42x longer than intended.