In the thread the developer is only able to look at the front-end code. The real problem is more likely in the back-end code where there'll be hilariously bad security issues. Hopefully Tan isn't running this on the same server or network as anything important.