MSNBC Article on my c2it security flaws. C2IT claims to have fixed all the problems, but I can assure you, I was able to run scripts on their site just this morning. It's pretty embarrasing that they should have been working on this for over 3 months, and all it is just filtering 4 nasty characters. They also locked me out of my account, so I can't test other flaws (account number access), but I'll see if I can get access later. See also the article in eWeek.