Unless your company is doing things on the level of trafficking minors or racketeering, then the information that comes out will be run-of-the-mill oopsies. Hav

Unless your company is doing things on the level of trafficking minors or racketeering, then the information that comes out will be run-of-the-mill oopsies. Having worked a bit in DevSecOps, I can tell you that storing clear-text passwords in places like version control files is much more common in companies than anyone would hope. Also, auth is just hard, in part because it forces servers to be stateful. Because companies have a wide range of options for dealing with the consequences of leaks, they'll prioritize security last instead of shifting left. Some common responses by companies include: - denying there's a problem - covering up the problem - acknowledging the problem in a blog and demand to be praised for the disclosure - blaming employees for the mistake To make a good plan, you can break down concerns piecemeal. What's the worst case scenario if attackers get a hold of employee passwords? What happens when users trust tampered content?