A (I believe) well intentioned developer is asking for the details of a Magento security exploit. Should these sorts of questions be allowed? Is there a general policy for this on Stack Exchange sites?
[insert standard security through obscurity bad vs. reducing surface area of exploit discovery discussion]
I know it was Magento Inc.'s policy to not discuss the details of security vulnerabilities publicly, even after they'd been fixed. Once eBay bought Magento Inc. the policy stayed in place, mainly to protect the segment of Magento's user population that never upgrades versions due to the IT costs involved.