Legal built a status page for internal systems

Reason:

Allegedly because the official form does not have a field for it. Built instead of the thing they were asked to build.

Built by:

unclear

Build time:

unknown

Built with:

Google Apps Script

Database:

MySQL on a machine under a desk

Authentication:

a URL long enough that nobody would guess it

Deployment:

on a cloud account paid by personal credit card

Responsible:

nobody. It has no owner.

Documentation:

one README with a TODO

Security situation:

the data protection officer does not know it exists

Future disaster:

It will become business critical in 14 months.

Rated common mostly because: 14% chance of becoming business critical, 1 departments depend on it, 6 users.