I worked at a company with that kind of app. It got owned three different ways. A user reported it after they saw it listed in a forum somewhere. It was mainly

I worked at a company with that kind of app. It got owned three different ways. A user reported it after they saw it listed in a forum somewhere. It was mainly app vulns, not platform, but there were certainly things that could have avoided it. The system was just not hardened at all, and the devs were sloppy. Luckily they had basic network security best practices and so it was confined to frontend, but blah blah SQL blah blah MITM, still not a good situation to be in.