I recently started work at new office that uses a proprietary program written by a solo developer. He's occasionally around as part-time tech support, but the company has signed off on this software and he's no longer being paid to develop it.
As a user of his software there are many issues that leap out to me as a source of concern:
- very simple to directly view the DB as a low-privilege user
- passwords stored as plaintext
- dictionary admin passwords
- app uses the DB root account
- DB doesn't meet 1NF (eg. appointment1, appointment2, etc.)
I feel like these are serious issues and that if I were him I'd want them pointed out to me, but I'm not a qualified programmer (I'm a social worker) and I don't know if it would be rude of me to just buttonhole him and start blabbering about salted hashes and normal forms, especially when this is no longer a paid task of his.
Is it out of line? If not, how would you broach it?
Edit - more info prompted by comments:
- The application holds sensitive data.
- It's for internal use, but it's running on lots of machines in several cities and many visitors come through our offices.
- My concerns are for the developer's future projects as well as this specific one.