I've discovered two kinda jaw dropping security flaws in a site I've already mentioned that takes money in a broker arrangement.