Thanks Jeff. It's worth pointing out that both issues were with 3rd party code and the Foo issue wasn't exploitable on the site. Tha said, we're releasing a complete rewrite next week or so which will take it all to the next level.