Only “minor” because they were in fact wrong about André being a risk. Had he been a real risk, this would have been about as major as it gets. They left him with root production AWS console and full production database access.

Fortunately he’s a standup guy and not a real security risk, so he emailed them immediately to let them know.