The real problem with CSRF vulnerabilities is that in most organisations, they're nobody's responsibility. The architects, designers and developers all think th

The real problem with CSRF vulnerabilities is that in most organisations, they're nobody's responsibility. The architects, designers and developers all think that security is someone else's problem. Like much security engineering, it's not that hard to design around but it does take a level of skill. One of the reasons that companies don't bother with fixing their development process is that they can pass on the impact to the end user. If someone renamed your Heroku instance, that's your problem more than Heroku's. Sure they need to fix it, but if the numbers are small enough then it's worth the customer service cost to them whereas your site is gone until it's discovered.