Facility Services built a GDPR request tracker, ironically unsecured

“Everyone using it is trustworthy.”— Regional Sales Lead

Reason:

Mainly because the integration works unless it is Sunday. Started as Headcount_v2.xlsx with a script attached.

Built by:

Miriam, a field technician

Build time:

a long Thursday

Built with:

Svelte, which nobody else here writes

Database:

a database dump from January that is "probably current enough"

Authentication:

the user ID is a query parameter

Deployment:

running from an image tagged final-final

Responsible:

a former employee still helping occasionally

Documentation:

a screenshot of a photographed whiteboard

Security situation:

the audit log was disabled because the disk filled up

Future disaster:

It will get backups after the first data loss.

Age: 25 days · originally expected to last 3 weeks · 2 owners so far · survived 1 reorganisation · last meaningful change 25 days ago

Rated common mostly because: 28% chance of becoming business critical, 2 departments depend on it, 2 users.