It actually sounds more like technical hiring and engineering culture was not good, rather than just PR. I know we all make mistakes, bugs happen, etc. Howeve

It actually sounds more like technical hiring and engineering culture was not good, rather than just PR. I know we all make mistakes, bugs happen, etc. However, if you can't reason through why it's not safe to bind an HTTP server to localhost and consider clients trusted on a laptop that might also run a web browser ... This and other prominent bugs suggests that among other things, security was not a part of the culture or mindset of the rank and file. I don't think you can use "it's a startup, bro" as an excuse for that.