I don't get why startups have such horrible security practices so often. It's much harder when you have to improve a legacy application, but these guys started from scratch! Does it really take that much more time to at least follow basic security practices? Even if one wants "to move and break things fast" I don't see how it would take that much more effort...