Apparently they don't run their security scanner against their own website ;-)