1. It was possible to change the id in a URL and see another users encrypted key. That is now fixed.
You're an idiot however, and that's not fixable. Who codes like that?!
Here's the most valuable question in this thread: Who's the babe in your profile pic??