> Don't you agree? Nope. I wouldn't want to PR this any more than I would want to patch PHP. I'd rather run the other way very quickly and use a well designed

> Don't you agree? Nope. I wouldn't want to PR this any more than I would want to patch PHP. I'd rather run the other way very quickly and use a well designed technology. To use an analogy, they didn't forget to lock the front door, they forgot to put locks on the door in the first place. It's more egregious than client-side validation; it's no validation at all. For the sake of being constructive, the application designers should read up about the security of any technologies they're using and make sure they understand the risks involved. They're developing an application that is meant to be used for sensitive information (about security breaches, no less) so they really need to make sure they know what they're doing. They can't rely on PRs from passerbys for their security.