A legacy SQL injection almost reached production until an internal security competition gave a developer permission to test beyond the release scope.