Like database unprotected on the internet (very short password too!), md5 for passwords, api key in the apps...