I’ve recently joined a company utilizing .NET, specifically with an older ASP.NET MVC code base. As a new hire and a junior developer, I’m considering reaching out to Stack Overflow for advice on refactoring and code upgrades.

My company’s business is b2b, so we trust all the users. However, I’m concerned about the absence of anti-forgery measures and the potential for SQL injection vulnerabilities.

There’s no anti-forgery protection, and SQL queries are constructed in a vulnerable manner like this:

"select " + userInput + "from table";

Should I focus solely on designing a robust login interface and turn a blind eye to the code, or should I actively advocate for refactoring to enhance security measures?

As a junior developer, I want to contribute to my company and its code base. However, the existing code is over 40,000 lines long and already runs smoothly. I hesitate to make changes because it feels like a huge amount of work and there’s a perception that I might be creating unnecessary tasks.