How can the developers behind an endpoint like this not confirm/test that it requires permissions/authentication to consume? (I mean, look at all that data...)
Amateurs I can understand - but OKCupid has been around long enough they shouldn't be employing people of that nature.
Is there no code review process?
This is just nuts.
And I will tell you on sprints where anyone is busy that team introduces something sloppy or nutty when one of us does not watch closely and ask, sometimes both. But when I point things out people are eager to roll it back.
Never attribute to evil that which comes from ... you get the idea!
It works so no one complains.
Are you implying that it's not outlanding for professional programmers to not have these things in mind?
> That's why it's so outlandish to me - I keep user data in mind all the time.
You keeping data in mind has no bearing on whether or not data leaks are outlandish. You don't seem to understand what the word means, tbh.
> Are you implying that it's not outlanding for professional programmers to not have these things in mind?
No, I directly implied that your real or feigned surprise at this happening makes it look like you don't understand the industry. If you're familiar with the industry it shouldn't be a surprise that this happens.