Regardless of if what the author did is deserving of sympathy, I think most of us can agree that the correct course of action is fixing the security bug rather than trying to cover it up. I mean we all know how well that works.