3 ms·

> ... but the person who had the idea of exposing an api endpoint to get admin user and password in cleartext .... I'd be hesitant to call out one person. A p

> ... but the person who had the idea of exposing an api endpoint to get admin user and password in cleartext .... I'd be hesitant to call out one person. A process failed. Where were the code reviews, design sessions, pentesters, QA, UAT, automated tests?

bsaul 7y ago
in some cases no particular individual are able to see something's wrong, and only someone with a general overview of the system can see the pb. in this case, every single individual in the chain ( from backend dev to frontend dev to tester to enduser) are able to see that something's very wrong. Which means none of those people are competent. Not any of them.