> because implementing the totally correct way is too time-consuming and expensive for the client There's your problem! > think about this as a structural pro

> because implementing the totally correct way is too time-consuming and expensive for the client There's your problem! > think about this as a structural problem of web development, not a problem of a dev not understanding enough No, go back to your root cause and fix that. From my research I've found that clients/managers only allow a development team to finish 15% of a feature before they consider it ready for production and demand a deployment. They don't understand security, testing, documentation, or hardening. Developers only have so much energy to roll these boulders uphill so eventually the crazy business people win. Today if you put a server on the internet you will be attacked within 20 seconds, and that will continue forever. If you start a business you have a 50% chance of being hacked. This really isn't an issue with the tools available, it's the developer effort and toxic work environment dubbed "Agile".