I have had developers turn round and say that security is not part of the spec so it doesn't apply to them. Yeah right.