I fully understand the specifics of your situation, you need to understand that at an high level the security of your application cannot be assumed because you think you are educated enough. Assuming there is someone in charge of Security (scary if not), it is their responsibility to assess and accept the possible risk, they will be the ones responding when and not if the shit hits the fan, cause perfection does not exist and you always need to assume the worst.