While I agree that social engineering and phishing are a major part of security vulnerabilities, let‘s not diminish the shoddy coding work of many companies out there that try to safe as much money as possible to please their shareholders by leaving out QA and ignoring or even threatening security researchers.