[mmmooo]

you are basing your 'token' on md5(data+secret), however md5 (and other hash functions) are easily extended when data and token are known, even without knowing secret. Basically, given data and token, I can produce a different token, that matches a (somewhat) different data, without knowing secret.

[dherken]

Sure you could, but then why would one go through all the hassle just to get a (probably already cached) screenshot?

[mmmooo]

well, for starters, I could use your (paid) account to get free screenshots.

[bpatrianakos]

But if you knew how to do that then you could probably set up webkit2png in a tenth of the time.

[mmmooo]

True, but what you are saying is only complex applications need to be secure?