After the developers there is a line of QA as well, but part of the problem is having the organisational structures for developers to discover issues like this.

After the developers there is a line of QA as well, but part of the problem is having the organisational structures for developers to discover issues like this. Regular audits, security as a priority and non-recrimination policies would be a good start. In many companies if you bring up problems like this then your "not a team player", in others you could point out issues like this all day long but they will never be acted upon because the budget isn't there for various reasons.