At school, EVERY SINGLE project we did, there wasn't one instance of them doing authentication for objects, just get the id and return the data. I was even mor

At school, EVERY SINGLE project we did, there wasn't one instance of them doing authentication for objects, just get the id and return the data. I was even more surprised were at my first job they were doing the exact same. Mind you this was production software already with hundreds of user dealing with sensitive personal data. People just don't know what they are doing. The best part was their s3 bucket with all of user's data was completely public read because "if we make it private we cant display the pdfs on the web site".