I really think we should stop being so mean to the submitter. Sure the code might have problems and the whole approach might not be advisable, but I am sure they have learned a lot from doing this. Ronsor congratulations for actually shipping.
Also, in my opinon, adding "Demo" means that it shows how to do it, but that's not clearly not how to do it properly.
Nowadays it's not possible to write applications without knowledge of XSS, XSRF, SQLi, redirects etc.etc. The security amount you have to understand is just getting ridiculous.
And let's not even mention DOS. No-one is securing against that and most servers can be made inaccessible by a simple script that just opens connections.
Considering that there's some low-hanging fruit still to be plucked, it's better for someone to point them out, and demonstrate the necessity to close these easily-leveraged gaps quickly, rather than to leave them open for someone much less scrupulous to misuse.