[djsweet]

> > it's the difference between a $200m raise with a bunch of untested API endpoints and a $10m raise with them.

> I'm tired of companies with API endpoints that leak data like a sieve. This is why companies need some skin in the privacy game.

There is a world of difference between “untested” and “insecure” API endpoints. What seems to have been cut in the example isn’t a permissions model, but some form of automated integration testing.

I’ve seen horribly insecure APIs with 100% code coverage, and I’ve personally burned myself on untested API endpoints where the privacy implementation was _too_ restrictive for what my customers were trying to do.

[3pt14159]

Ostensibly based on what I said, yes. But in reality, he was right that untested meant partially insecure. There are real costs to tech debt. But it's hard to argue against a giant raise.