Thanks for pointing out this problem. It does look like a security issue. We'll investigate it.
Paco