Comment by crdoconnor

I've noticed that a lot of companies don't pay attention to developers who raise security issues - they usually just hire an expensive consultant and pay them to tell them what to fix.