True. Hiring better programmers is more expensive, but in the case of vulnerabilities the long-term cost of not doing the right thing are probably higher than t

True. Hiring better programmers is more expensive, but in the case of vulnerabilities the long-term cost of not doing the right thing are probably higher than the upfront cost of hiring someone more qualified. The original tweet, for example, reeked of crappy hand-crafted PHP code. Pretty much any web framework, even PHP ones, wrap bare exceptions like that into a proper 500 error with no information about the underlaying system. How long will it take for someone to put two and two together (MariaDB, no escaping of user input, a users table of some sort) and come up with a SQL injection that exposes all the password hashes for that website?