There are security issues, and then there is this.
Not doing authentication on some things isn't a "oh shit" moment, it's a "we're doing all of this very wrong" moment.
Not doing authentication on some things isn't a "oh shit" moment, it's a "we're doing all of this very wrong" moment.
Then again it's all over HTTP so that was off to a bad start.
Security is not a game, and it's not an afterthought. But some days it seems I am the only person who feels that way. I still don't shop at Target or Home Depot. They need to feel the impact of their business decisions, instead of putting the cost of security onto their customers or the customer's bank.
After seeing how they acted after their security breaches, I left for DigitalOcean. I've also recommended DO over Linode to other people for that reason.
I should note it wasn't the fact they had a security incident, that happens. It was the way they 'communicated' it.