This is honestly the kind of mistake I'd expect a child to make. It shows a complete lack of understanding of how the web works. And this was put into production by a so-called security company? I think a name and shame is appropriate here. This isn't excusable, it's just straight up incompetence.