Brightkite API puts user information at risk

The Brightkite API allows 3rd party websites to access information of a logged-in Brightkite users via JavaScript, even without their a) consent b) knowledge. Of course, this information is submitted to Brightkite in the first place as "semi-public", but giving away your current (exact, the one meant for friends) location, sex, etc. to a 3rd party without knowing it does not make me very happy. This also includes direct messages sent to other users!

I will not disclose all the details here, so please contact trinta (at) gmail dot com for further details.