Here is an example from my career: I once found a SQL injection at a large internet company (I won't say which one) that dumped user accounts including hashed p

Here is an example from my career: I once found a SQL injection at a large internet company (I won't say which one) that dumped user accounts including hashed passwords, email addresses, comment history, and a ton of even more sensitive data. The management of this company did the math and said the risk of someone maybe finding it vs the cost of the dev team missing a feature deadline made the vulnerability less important to fix. The sad part is that they were proved correct. The dev team finished the feature and then merged in my fix for the injection (it was a relatively large fix involving a large constructed SQL statement and I wrote it in my off hours because I couldn't just leave it). No one found the issue and the feature landed them new business. In the end they got what they wanted, the fix and the new business, because I gave up extra hours. That's when I decided that app development better suited me.