You would be surprised how little effort sometimes goes into code reviews or security scans. Up until recently the team I was dropped into didn’t have any auth

You would be surprised how little effort sometimes goes into code reviews or security scans. Up until recently the team I was dropped into didn’t have any authentication for all their endpoints, I pointed this out and secured them all, except for one. This one endpoint was only used internally, but was still exposed. During multiple security scans and a penetration test, this didn’t even come up. I even had a hard time convincing our product manager this should be secured, and could be done in an hour or two, if I could get some time.