A web developer noticed a major security risk in the new website’s code, but his boss told him that’s how she wanted it, so he let it go