I think we shoudnt even call it a vulnerability. They send the 'secret' information in the html file, hoping that the browser does not render it (which it doesn

I think we shoudnt even call it a vulnerability. They send the 'secret' information in the html file, hoping that the browser does not render it (which it doesnt, so 'viewing source' was the way to see the information). I am actually surprised that the dont charge the person who set up that system; it is like broadcasting the confidential information.