I was admittedly a little heavy handed on the sarcasm (it's been a long day).
Absolutely appreciate that they were open and honest about this and that it was discovered during an audit and fixed.
Sigh was more that best practices may or may not have been followed up to this point, and there are likely many other companies with similar holes that may not have been as proactive or transparent as WP.
