[goguy]

I'd expect even a junior to at a minimum test and view the response payload, see the token and think "bad idea".

[lol768]

Agreed, this is far too basic for the "oh yeah, a junior developer might not have noticed it" excuse.

Hacker News seems to assume juniors are useless, from the comments I've seen to date - but they should be able to _think_ and solve problems, even if they're less experienced at interacting with stakeholders, designing system architecture etc.