Do you have a citation to show that, in any US jurisdiction, a developer can be personally liable for the release of software with a security flaw while managem

Do you have a citation to show that, in any US jurisdiction, a developer can be personally liable for the release of software with a security flaw while management at the same company can't be?