One of my team members committed a huge mistake; a clear SQL injection-vulnerability. It obviously didn't pass my peer review and I made very clear that this is unacceptable. I never saw this programmer make this mistake before and I'm unaware of any other security holes this particular programmer committed. The problem is fixed and my explanation is understood.
- The programmer is now aware of this mistake and probably won't do it again.
- The problem however was huge and could have had major consequences when brought to production.
- It's not a junior programmer (> 5 years experience).
Should I tell the manager?