You have my sympathies. Your situation seems pretty much like my own. I have been brought into a medium sized company to program back-end database code for them. Not a particularly hard thing, you may be thinking... DBI you may be thinking.

Then imagine my shock and horror to find that my predecessor had built his own database system... one that had huge problems with multiple use!

I'm not sure he had even heard of CPAN, let alone knew it's use.

Finally, he took the notes in perlstyle and did the complete opposite. No comments, meaningless variable names, a naming scheme that is_sometimes_like_this and SomeTimesLikeThis and SOMETIMESLIKETHIS :P

None of the sites he developed for are trivial and all of them have had to be changed.

Do you believe that developing Web sites means you can't have adequate specs?

I believe that any nontrivial program needs a full and complete spec. By nontrivial I mean any program that performs more than one simple task or branches or requires user input.

Do most Web development companies take security seriously, or is it treated as an afterthought?

After 4 year's work in the internet industry I am sorry to say that very few companies take security seriously. All of them do things like installing firewalls but very few of them will sit down and try to work out, for example, how a script can be hacked.

Is your company averse to installing CPAN modules, even if they have been reviewed carefully?

They aren't any more now :P

Do you have a job for a Portland, OR monk ;)

Considering the difference in pay between the US and the UK I would stay where you are ;)