The report from a software company’s vulnerability scan comes back looking reassuring. Nothing major shows up. Confident that its customer portal is secure, the development