[jrockway]

It's not particularly constructive to think of individuals as being responsible for single bugs. Bugs are random events, and their probability increases as people and processes become complacent.

A good way to react to this bug is to come up with ideas for reducing the possibility of future bugs: static analysis tools, making code reviews easier, and so on. One might also think up ways to lower the impact of future bugs; make session cookies unavailable to JavaScript, propose new standards for the web, etc.

It's important to think of it from a statistical standpoint. Given two equally skilled developers, the one that implements more features is more likely to be involved in a production incident. If we punish people for bugs, we're punishing productivity in addition to sloppiness. That sets the incentives incorrectly. It isn't even a good idea to blame one person: if you scare one person into compliance, you still have the 29,999 other SWEs that aren't scared into compliance. Much better to develop tools that make bugs easier to spot, because every hour you spend doing that helps 29,999x as many people.