As you probably know, this is not uncommon. Project managers choose what they prioritize and security often either falls off the bottom of the priority list or

As you probably know, this is not uncommon. Project managers choose what they prioritize and security often either falls off the bottom of the priority list or is addressed by engineers who only know enough to shoot themselves in the foot. To really shore up security, you need to raise it's priority and in a mature project that can involve a daunting shift in momentum. Developers and testers are in a rhythm of pursuing other goals. As the "new guy", you'll have little influence to make that shift happen in a significant and lasting way. But here's what you can do: 1. Document your understanding and share it with the project manager. All this will do is nudge the ship a little bit, but that nudge can start a process that pays off later. 2. Take advantage of the fact that you're new. Unlike the rest of the team, you currently only have a light impact on the rhythm towards other priorities. The project momentum may be large, and so might the momentum of more senior developers, but yours is not. Pitch your "minimal gets you 90%" work as both an opportunity to triage the most pressing security issues (buying time before a bigger momentum shift is necessary) AND as a way for you to gain familiarity and ownership of a new part of the code. You'll get exposure and commit history for some new files and will likely become a first-pick candidate for a more substantial security effort later on. They may not bite on this, but it's really the most you can make a strong case for. Good luck!