Notes on known security holes

• Non-verified users could pull out facebook avatars of members by guessing URLs