> now here's how to fix it (he didn't tell him, he just says in his blog post "it's easy")

If you're running a service that handles sensitive user data and need a third party to tell you how to update your web server, you shouldn't be handling such data at all.

Personal data leaks from apps like this are only going to become more common (especially considering the rising popularity of "vibe coding") unless the people behind them are forced to take responsibility for their lack of security.

Perhaps, but there's no need to act like a prick about that