Yeah my old place didn't give a shit, features were our success criteria. PMs don't usually care about security really, they also just want to check off boxes.

Yeah my old place didn't give a shit, features were our success criteria. PMs don't usually care about security really, they also just want to check off boxes. Like my old PM wanted to load test the CDN (AWS) we were using just so that we could check off a DDOS proof box. I said that load testing AWS was pointless and that we should load test our supporting infrastructure instead and he just dismissed it. Kinda makes me feel a bit depressed about the state of the industry tbh