[pixl97]

Developers are perfectly fine with writing insecure JS all by themselves.

[yawaramin]

But developers don't typically write malware to deploy on their production systems.