OK, who was it?

[DaveB]

Coding shonky websites again....

THREE MILLION Moonpig accounts exposed by flaw

[Jeebo72]

Having worked there previously, I probably know the person. Not me though.

[NickFitz]

It's a good one, only improved when somebody discovered that it also works over HTTP (no S) and without the Basic Authorization header

[vwdan]

The architecture is bad, but the decision to ignore the warnings are downright gross negligence.

[mudskipper]

First thing I check on any site that sticks a customer or orderId in the querystring. eek's choccie site passed the mudskipper security check. So does CUK

[OwlHoot]

God, that's diabolical - It's bad enough having the problem in the first place, but once once they knew of it then not bothering to fix it for months is incompetence beyond belief.