"Not a small startup with 6 people who all know what they are doing." Another scenario is a small startup with 6 people who _don't_ know what they are doing, b

"Not a small startup with 6 people who all know what they are doing." Another scenario is a small startup with 6 people who _don't_ know what they are doing, but the auth code has got to get written somehow. By the time the company gets big enough to have major high profile customers the person that wrote the auth code is now in a senior management position, the senior devs don't want to touch the auth code because it "works" and they know better than to break something just because a junior programmer has raised a theoretical issue they only just understand and they've never seen in the real world. (I may have been that junior programmer. I'm sure there have been more since then.)