My employer is a staffing company, and I'm on a 4-month contract with the client. The client gets funding from the National Science Foundation, Bill and Melinda Gates Foundation, and others.
They make an app for kids, used in classrooms.
I've found numerous security flaws in the software. The worst is: When the child student clicks "logout", the system tells them they're logged out, but they're actually not. It's possible to continue to initiate actions through the UI as the child.
I brought it to their attention twice and the managers aren't too concerned. The developer responsible for the system (with custom coded security functions coded by him) was defensive, saying that it probably wasn't a big deal, and it'd be impossible to test. I know this is B.S., of course.
I'm considering my range of options.
(The other security flaws also implicate COPPA because they risk childrens' indentifying data: API keys, to e.g. file storage services, exposed in the app.)