Security Model Bedfellows

The penetration test finds a bug in the code that was coded four months ago and could have been prevented a year ago during requirements gathering. The vendor says they will fix it shortly after the software launches - if a change order is issued and they're paid for their work.