Note: I submitted this last night to HN but it didn't get picked up. I thought it worthwhile to re-post given that the visibility of a similar HN thread was what clued me into this security problem in the first place.