I have been assigned to develop an integration to one of my employer's applications to an external system developed by our client. Our client's specification for the integration that has some blatant flaws related to security. The flaws would allow an unauthorized user access to the system to view restricted data.
I have pointed out the flaws and their potential security risks if they are implemented as designed, and provided an alternative without the flaw, but (in short) have been told "do it the way we specified" by the client.
Does a programmer have an ethical responsibility NOT to implement code with known security risks? At what point do a client's requirements outweigh the ethical responsibility we have as software developers to create secure applications?