Hitchen's razor applies here: "What can be asserted without evidence can be dismissed without evidence."

It's unfair to assume poor security practices. It's also ridiculous for a Show HN to be expected to meet a burden like "separation of access" when it's likely a person, singular, that has produced this app.