They possibly felt that you were suggesting it was a lot of work to fix this, when in reality it would take a couple of hours to add sanitization checks to the inputs.<p>You&#x27;re also overestimating the business impact of a security breach.  This is an area where people&#x27;s moral compass overrides their shrewdness.  Notice that Anthem is still in business despite the worst possible breach, for example.<p>It&#x27;s worth trying to improve security, if possible. But it takes one of two things:  (a) leverage, or (b) patience.  One of the main reasons that companies get a security audit is because a different company forces them to.  They get an audit in order to obtain a CFD (client facing document) saying that they are secure.  Without this, the other company will not do business with them, which is the sole reason why the security audit happens.<p>The other way -- patiently pointing out ways of improving the situation, and explaining the business merits of allocating time to this pursuit -- does not usually result in meaningful security improvements.  This is an unfortunate fact of the industry, partly because security breaches do not usually put a company out of business. There are exceptions to this, but that is the common case.