I really hate how they are rolling with the Australian gym incident. They had a completely open API. Imagine having a button on your front page that sends you to the admin page without asking for a password, and then telling people you were "hacked".