they relied entirely on their cloudflare to prevent DDoS attacks, yet didn't prevent direct access to their server via IP, basically meaning their ddos protection was doing nothing for like probably years. i reported this, nothing was done, and then had to report it again months later before a fix