I briefly worked for a company making a web-based product where the security was abysmal. What was shocking was that I had to explain to the lead engineer the

I briefly worked for a company making a web-based product where the security was abysmal. What was shocking was that I had to explain to the lead engineer the "never trust the client" security concept. A few hours later he found a major exploit. I suspect that there are many small software companies with similar problems.