Customer Support built a GDPR request tracker, ironically unsecured

“It's only for a few people.”— Marketing Manager

Reason:

Because the customer asked for one tiny change. With a settings page that does nothing.

Built by:

Lukas, an analyst

Build time:

a long Thursday

Built with:

an AI agent with shell access

Database:

an Access database called Budget2026_FIXED_use-this-one.xlsx with 11 linked tables

Authentication:

the browser says "Not Secure", but only in red

Deployment:

behind a domain Elena owns privately

Responsible:

Marco, who insists they are not the owner

Documentation:

two architecture diagrams that disagree

Security situation:

the database is reachable from the public internet

Future disaster:

It will be described as "legacy" before its first birthday.

Age: 7.1 years · originally expected to last 4 weeks · 4 owners so far · survived 3 reorganisations · last meaningful change 3 days ago

Rated common mostly because: €255k per year, alive 87x longer than intended, 2 departments depend on it.