One would hope that even average developers for a payments company would have a better understanding of security than to make mistakes like this...