How not to write an API
Short version: <a href="http://criticker.com" rel="nofollow">http://criticker.com</a> sells access to their API for apps. Any API account can retrieve a list of all users it registered on the site, then retrieve the cleartext password for each user it created.<p>There are so many WTFs in this whole situation that it's a wonder criticker has managed to keep the website online. Which is a shame, as it looks like a really useful website.