&gt;It feels bad, but considering the resources we&#x27;d need to pour into getting one of our better devs trained in all the facets of web app security, it&#x27;s unlikely to change any time soon.<p>Consider the resources you&#x27;ll have to expend in the event of compromise and compare. While this analysis doesn&#x27;t <i>always</i> prove the slower but more secure approach to be cheaper, it usually does. Unfortunately, you usually can&#x27;t get the people holding the purse strings to accept the trade until they&#x27;ve been bitten.