HR built a GDPR request tracker, ironically unsecured

“There are only like twelve users.”— Kevin, HR

Reason:

Honestly? Because the document management system is only reachable on the VPN, which drops every 43 minutes. Forked from a tutorial at 17:59 and never cleaned up.

Built by:

Kevin, someone from Procurement

Build time:

a long Thursday

Built with:

an AI agent with shell access

Database:

Supabase on a free tier that pauses in 20 days

Authentication:

the password is the company name plus 2023

Deployment:

on a Raspberry Pi in the server room

Responsible:

Lukas, currently on parental leave

Documentation:

a Loom video nobody can find

Security situation:

IT has not been informed and will not be

Future disaster:

It will become business critical in 6 months.

Age: 96 days · originally expected to last 7 days · 2 owners so far · last meaningful change 96 days ago · original builder left 32 days ago

Rated common mostly because: €268k per year, the builder has left, alive 14x longer than intended.