I do appsec for a living now and it is amusing how few people question stuff. I have made a name in a small firm by finding something easy, but usually severe,

I do appsec for a living now and it is amusing how few people question stuff. I have made a name in a small firm by finding something easy, but usually severe, and coaching coworkers who had no idea. Of them I one of the most junior, and we replaced security people from before and the most senior has been here 2-3 years. Some of the stuff I'm busy writing up has 5-10 precedence in the company and upsets lazy culture and repeat copy pasta. And I will tell you on sprints where anyone is busy that team introduces something sloppy or nutty when one of us does not watch closely and ask, sometimes both. But when I point things out people are eager to roll it back. Never attribute to evil that which comes from ... you get the idea!