> Who codes based on email requests? Trust me, it's a thing in many orgs. In fact, centering developer discussion on an asynchronous email mailing list (or mor

> Who codes based on email requests? Trust me, it's a thing in many orgs. In fact, centering developer discussion on an asynchronous email mailing list (or more functionally but rarely, an internal NNTP server) used to be a preferred practice. > how is that thinking like an attacker? You are not thinking about anything attackers are interested in. I think you're using a rather narrow definition of 'attacker'. It isn't too rare to encounter adversarial attitudes within and between groups in an org. Sabotage per-se is less common, but does exist. At a most basic level, your KPIs look better if someone else's are worse.