Avoiding the bug in the first place is not the big issue, surely. An employee can leave a door open to a secure area, if you employ security people they should

Avoiding the bug in the first place is not the big issue, surely. An employee can leave a door open to a secure area, if you employ security people they should have worked to mitigate that, and to catch it if it did happen. Well "we want to run an audit to find if any passwords are stored in plaintext in our file systems". Sounds like a problem any highschooler could answer? The idea of an audit might need a person who has done a remedial level of security work.