Nobody in this industry consciously neglects authorisation, especially not startups building security solutions. This sort of stuff sometimes just happens, and

Nobody in this industry consciously neglects authorisation, especially not startups building security solutions. This sort of stuff sometimes just happens, and the root cause always eventually boils down "we are humans and it is a human thnig to make mistakes". They have displayed fantastic response time and transparency on the issue, had the infrastructure in place to assess the impact, credited the reporter, hang out on HN to answer questions... If anything, this kind of response builds my confidence and trust in them.