[GlowHost.com]

I can't really comment on the security issue, other than the following:

Everyone has their own opinion of what security "should be." There is almost always a trade-off for functionality vs. security and users have to decide where that line is on their own. Keeping the scripts up to date, maintaining an adequate server-side firewall, and strong passwords are generally good enough.

As a suggestion, ff you want to maintain functionality of this mod, other mods, make your upgrades easier for mods and the forum scripts themselves, and add another level of security by simply password protecting admincp and modcp using your web servers http_auth functions. Then keep modcp and admincp where they belong.

Now your crackers have to first guess your web authorization and secondly they have to get past your script authorization. It's unlikely.

Your bug comments are good to know cfish. In this case, hopefully you can wait until 2.x to get past these issues. Hopefully the trade off in reduced spam is worth it. In 2.x we will be removing those functions and making it one stop shopping from the postbit to delete, soft delete, ban etc so the need for admin or mod panels will be bypassed completely and productivity will be increased by just doing the dirty work on the front-end of the forum not the back.