Damn, that's actually pretty concerning. I hope the Busy.org development team gets around to fixing this soon. I guess I can revoke their access to my account until then.