As you are aware, it only sends an email to people who have marked install. And the thread update will only reach people who have subscribed to the thread (actually not, even that, because I never got a subscription notice when the thread was updated and moved).

We are all very much aware that the installed number only represents a portion of the actual installs.

In a recent vbBux thread, the problem is referred too as a 'security exploit' which is a better way to go.

How it should be worded is always debatable, everyone has their own views.

I believe users should be told whether it's XSS or MySQL or whatever - without further details you cannot exploit it anyway.

with any detail like "sql inject" or "xss exploit", you can exploit any hack because they are not encoded... with a hack with a single sql query, it is easy to learn how the inject can be done...

if instead you contact the coder, that coder make the change in a reasonable delay, and then update his script without noting the exploit, it would be infinate the risk of a hacker trying to reproduce the exploit and profit from it...

and btw,as anybody can suggest changes to a hack to the coder, why not providing a fix yourself as you already know the exploit, so the coder simply have to update its release... this is a community of sharing after all...

I'd also recommend that as new exploits are discovered, they are given examples, along with the fix, in the private coders forum - probably in a sticky, indexed thread. This way coders can keep up on their old hacks, and avoid possible problems with their new ones.