security in any application has to start from the beginning and nurtured by all developing this application. security can not be a bolt-on after the fact patch works. when at least these two are not applied all applications will fail miserably. security by obscurity only a make believe.