Remove the unsafe package asap, and do database operations the safe way.
edit: For downvoters, the author has the 'development mode' package still in the project which allows you full read/write to the database without any credentials from the web console. All that is necessary is for someone to guess the name of one of the collections.
What made you say that? Maybe it's changed now but I don't think the site had that package? Were you able to modify content through the browser console?
Comments
Remove the unsafe package asap, and do database operations the safe way.
edit: For downvoters, the author has the 'development mode' package still in the project which allows you full read/write to the database without any credentials from the web console. All that is necessary is for someone to guess the name of one of the collections.
What made you say that? Maybe it's changed now but I don't think the site had that package? Were you able to modify content through the browser console?