> I had one person explain to me their XSS injection vuln was intentional because patching it would break some JS plugin

Changing the "password" field on http site to "textarea" with hidden css rule is another great one- to get rid off the browser warning. As it was explained to me, because TLS is too much hustle.

Oh that’s golden, I’m going to remember that one and pop it out as an example some time. Thanks for that!

Really refreshing to see someone say they might do the same thing if the tables were turned. It's easy to judge others shortcomings in what we know, but there's probably plenty of other things that we have our own shortcomings with.

Thanks! There’s a reason large enterprises spend a ton of resources on security while SMBs are vulnerable on just about every public attack surface: priorities.

Well that and expectations. Most small business owners see security as part of the developer’s job. However don’t realise it’s something that needs non-stop attention as websites and technologies in general are affected by erosion. What’s safe today might not be tomorrow. The developer isn’t at fault for that, and yet the website owner refuses to foot the patch bill, or pay for continuous monitoring.

I could write all day about this and we’ve only been in the trenches for a few weeks now :p