Ding Ding Ding. And the always verbose tilly comes in with the answer I was looking for: Dumb Luck

The malicious hacker does not need to know your code to abuse it. Some kid who knows LWP and has plenty of time on hand can easilly write a simple little script to go through a handful of different attacks on a list of sites that the kid has visited recently. Ooops... there goes your day. ++ for tilly