I wouldn't even say a reprimand is necessary here. Programming safety is like safety in auto racing or rock climbing: you build the safest thing you can, but t

I wouldn't even say a reprimand is necessary here. Programming safety is like safety in auto racing or rock climbing: you build the safest thing you can, but the activity you're doing is inherently unsafe, and it will generate failures despite the presence safety measures, so you do your best to study those failures to mitigate them the best you can. The only time adverse action like a reprimand is necessary is if the manager or tech lead don't take any action to prevent future issues. The only time a firing is necessary is if the security issue was created with intent, rather than accidentally.