I'm not sure if you can extend bugs to that many people, since usually bugs and awful code are not tied into the requirements or the acceptance criteria. That b

I'm not sure if you can extend bugs to that many people, since usually bugs and awful code are not tied into the requirements or the acceptance criteria. That being said, I do hold code reviewers partially responsible if shit gets past to production. A code reviewer is able to see that someone is building SQL from raw input, the QA isn't. And if I see that a developer writes that kind of a thing and another person approves it, the first question I have is if they actually read through the code or just glanced at it.