Is there a reason bugs.python.org/review is running in DEBUG mode right now? I was just poking around and came across the debug 'DoesNotExist' error page when accessing: http://bugs.python.org/review/rss/reviews/cjwelborn Then, instead of a 404 I get the 'Page not found' debug page. So, just glancing at the acceptable url patterns I see one that will give you a xsrf token (if you send the appropriate headers, which is easy). I'm not a web expert, so I don't know how dangerous it really is. But the error messages were really helpful (in a bad way?). This turned up an actual error. I'm pretty sure it's an actual error, though I could be wrong. It might be an 'expected error'. When accessing http://bugs.python.org/review/account , I got: KeyError at /review/account: 'AUTH_DOMAIN' /home/roundup/trackers/tracker/rietveld/codereview/views.py in account: domain = os.environ['AUTH_DOMAIN'] Maybe someone is doing some testing and I'm just wasting people's time. I thought it would be better to say something, so if it is a mistake someone can fix it. -- \¯\ /¯/\ \ \/¯¯\/ / / Christopher Welborn (cj) \__/\__/ / cjwelborn at live·com \__/\__/ http://welbornprod.com