Facilities built a GDPR request tracker, ironically unsecured

“Supabase probably handles that.”— Head of Operations

Reason:

Honestly? Because the architecture diagram contains a box labelled "magic". With 105 users and zero documentation.

Built by:

Chen, a controller

Build time:

19 minutes

Built with:

Power Apps, licensed to one employee

Database:

17,802 XML files

Authentication:

the security model is a locked office door

Deployment:

running on a VM with 1 GB of free disk space

Responsible:

a team that has since been reorganised

Documentation:

a Confluence page marked "draft", last edited 823 days ago

Security situation:

the incident response plan starts with "call Miriam"

Future disaster:

It will turn out to be the only system that knows the real numbers.

Age: 318 days · originally expected to last 7 days · 2 owners so far · survived 1 reorganisation · last meaningful change 3 days ago · original builder left 279 days ago

Rated common mostly because: €155k per year, 44% chance of becoming business critical, alive 45x longer than intended.