Recently I have project in which a directory listing is enabled, due to which some scripts can be seen by outside world. I asked website administrator and he said it's not his responsibility, its the programmer's job. I also asked programmer about this and he said that the script is actually a cron job, and according to him, he has to test the script on webserver as there is a difference between development and production environment, so he placed there to test that. According to him, there was no direct link as he assumed directory listing is disabled and taken care by administrator.
Who is the right person to do this?