There are also lots of programmers who are clueful about security, but work for clueless managers or organizations. I've had many a conversation that went like

There are also lots of programmers who are clueful about security, but work for clueless managers or organizations. I've had many a conversation that went like this: "Okay I put together this prototype and it's working. I should check it over for SQL injection spots and---" "StoptalkingnotimeforthatSHIPITNOW!"