I once bluntly refused to deploy an app to production because it was a finance system that handled billions of dollars and the personal data of a million children. The HTTPS certificates couldn’t be organised on time (don’t ask), so I simply refused to deploy it using HTTP only “just for now” (=years).

The look of stunned shock on the project manager’s face is something I’ll never forget.

He was apoplectic with mixed rage and incredulity.

“How dare you refuse a direct order!?” — but now picture a red face and spittle literally flying around the room.

He immediately called my supervisor and up all the way to the CEO of my consultancy.

That’s what happens when individual contributors push back. In general there are zero legal, corporate, or personal protections.

“Do as I say or consequences.” is the norm.

In this situation I was incredibly lucky that the CEO trusted my judgement and told the PM to take a hike. Even if I had been fired I would have been okay.

Most people can’t take risks like that on principle.

That’s fundamentally why enshittification happens, and why every mobile apps’ data collection dragnet would make an NSA spook blush.

Only consequences for directors and up matter. They're the ones that need to feel the fear, not the poor outsourcer struggling to put food on his family table.