In reply to mark k..

@Pippin, I actually said nothing about having the security issue, I was refering to the idea of shipping code that the developer himself knows it is not a release grade code marked as a release grade. That would have been a surprise if such design decision did not result in some exploitable code or just major major bugs that would have totally surprised people that are expecting a release grade product.

Now the specific issue was solved, but was the design issue solved? Unlikely. So what bugs will be introduced in their next release from the code that "should not be active at all", but made active by mistake?

It is one thing to have one beer too much while coding, and another thing to plan to use the wordpress.org users as beta testers without their knowledge.

And about your bug, that is exactly my point, when I install EDD the question I have in mind is "say pippin had access to my admin, would I have been able to trust him not to do something stupid?" because installing anyone's code is in a way giving him admin level access to your wordpress, whether it is exploitable or not.

Side note: It is nice to see you and others come to the defense of people that had a bad day, but if those people are not publicly whipped (yaost, jetpack come to mind as examples right now) what incentive will they have to improve? It sounds like any shenanigans is ok from plugin and theme authors as long as it doesn't involve ads, or they say sorry. The chances of anything improving code wise in the ecosystem when failures are so easily fogiven is slim.