The security team can certainly need some help. One would think that the people who as of recently are Drupal's saviours when it comes to enterprise solutions would be eager to spend some ressources on this.

Gerhard, I am not an expert, so I can't do the actual bug finding and the fixing thereof, but I *can* do the legwork. If there is something I can do, please let me know. Kobus