Marketing built an email campaign sender bypassing marketing

“The data is mostly public anyway.”— Nadia, Marketing

Reason:

Because Katrin has the only working copy of Invoices_Q3_new2.xlsx. With 2 users, one of whom is the CEO.

Built by:

Nadia, a warehouse supervisor

Build time:

4 evenings

Built with:

a Rails app from 2016 nobody updated

Database:

a SQLite file on a network share

Authentication:

Basic Auth over plain HTTP

Deployment:

deployed on Monday immediately before a public holiday

Responsible:

Elena, because their email address is in the config

Documentation:

a Confluence page copied from another project

Security situation:

the API key is shared by 5 applications

Future disaster:

It will be used for an audit nobody told Katrin about.

Age: 3.0 years · originally expected to last 4 weeks · 2 owners so far · survived 3 reorganisations · last meaningful change 210 days ago

Rated legendary mostly because: 6 accidental connections, 76% chance of becoming business critical, alive 37x longer than intended.