It's weird, is there no feedback of any kind in these companies?

All outsourced maybe?

I don't get it. That would be a huge red flag and a fairly easy to understand / sell red flag.

Even if it was outsourced is there zero quality control?

Probably QA is only going to make sure the features work. They aren't pen-testers. At best, they might try some unexpected inputs that trigger a security vuln.

Outsourcing means you want to impose an upper limit on the cost of the feature/software. Quality control may cost more, so yes!

The acceptance criteria are: service portal needs to work so employees can do xyz. The design is terrible but "works"!

Having to rearc after these terrible designs would cost more, so you can see where this is going...

I joined a startup with a product in production for a dozen or so major customers (US universities), public facing, with a slick new front and backend the team had been working hard on. I brought along a young engineer friend who had a pet interest in pentesting, so his first task before getting up speed as a dev was a security review.

He and I sat down on day one to poke around, mainly to get oriented, not expecting much l. Popped up Chrome's devtool network panel, refreshed the login page.

One of the first XHR rows was to an endpoint named “getKeys”

The return object was the root keys for the AWS prod account.

This crap is incredibly common. Maybe not that egregious, but close enough.

>$('#securityQuestionModal').modal('show');

Iv seen a couple of industrial deployments "secured" by a modal so Im totally buying whats in the article.