Gab removes their public Git repository after it reveals their developers adding (and struggling to fix) basic security issues that led to a 70GB data leak

Eh, while the matter of whether or not to think less of the person in question is something I'm not going to get into, this is an extremely egregious error, not just a simple logical mistake.

For one, Gab is a rails app (apparently) - so they first have to completely ignore Rail's built in ORM, or query builders, since that will automatically sanitize your queries, and step down to doing raw SQL queries. Secondly, they also have to be okay with using string formatting in a query. That should ring about 100 alarm bells in the back of your head just glancing at it. Just use prepared statements if you have to step into SQL!

Just looking at that screenshot instantly says "SQL injection".

Even worse is that this is all documented very clearly by rails

That this was also done by the CTO of the company is, uh, honestly maybe it makes more sense, since a more junior developer would probably, like, try to adhere to Rails convention and read documentation.

In modern webapps (which Gab ostensibly is), SQL injections are rare now, because a) they're so infamous b) modern frameworks handle sanitization for you.

It's one thing to, say, not check bounds on a buffer in C and woops, there goes another stack smashing exploit. It's true that that's extremely easy to miss (although modern code analysis has gone a long way into automatically detecting simple variants), and even the best of C code inevitably seems to have issues. But this is a different league.

It's like if your "professional" valet is driving your manual car and switches to the reverse gear while at speed accidentally. That's how egregious it is.