upvote
That assumes the key is actually on the server.
reply
I assume even if it isn't, attacker could deface the website so heavily everyone would know they win.
reply
The server could simply be running a patched PHP.
reply