This is what I think when I hear about a company being attacked by someone inside their development/ops team or the latest 0day. Ideally there should be measur

This is what I think when I hear about a company being attacked by someone inside their development/ops team or the latest 0day. Ideally there should be measures in place to mitigate these worst case scenarios but those are legitimately hard, expensive, and require commitment at all levels of the company. This wasn't that. The worst vulnerability was caused by a very basic mistake that was more at the level of fundamental competence than security expertise. If you're going to use GraphQL you need someone who knows about GraphQL. It's been out a while now, they aren't that hard to find.