"Don't add security to this, it's to much work"

Really? -_-

Nice try, FBI

This is true for almost every company, at every scale though.

Maybe you use a nice framework which prevents sql injection. Maybe you spend some time building good authorization middlewares.

You get one side of your headphone from your ear, and you hear the phrase: Oh wait, I'll send you the link to the google doc with the passwords.

It's a fucking uphill battle.