Quality Assurance built a GDPR request tracker, ironically unsecured

“It's more of a prototype.”— Finance Business Partner

Reason:

Mainly because the CEO found the one button that does not work. Renamed three times to avoid attention.

Built by:

Jens, a controller

Build time:

a long Thursday

Built with:

Python and a cron job on a laptop

Database:

a database on Miriam's laptop

Authentication:

the encryption key is in the source code

Deployment:

deployed on Tuesday immediately before a public holiday

Responsible:

Thomas, who insists they are not the owner

Documentation:

a PowerPoint with 48 slides

Security situation:

the incident response plan starts with "call Sofia"

Future disaster:

It will cause IT to ask "what server?".

Age: 90 days · originally expected to last 3 months · 2 owners so far · last meaningful change 90 days ago

Rated common mostly because: 2 departments depend on it, 1 users, €1k per year.