Honestly, after all of this, I would trust mt gox the most. Nothing encourages you to invest a lot in security more than being thoroughly pwnd.

It's funny and it's true.

GLBSE.com of course, we don't actually use passwords.

We are not however a bitcoin exchange (we're an asset exchange)

And it's down until I have security beefed up.

Nefario.

Hmm well this is totally cool, now the hackers know exactly what sorts of attacks will work by analysing the source code for vulnerabilities. I don't recall any wall street banks leaving the schematics for their security systems lying about on the roadside for any gutter trash to read, do I?

It's secure because anyone can view it.

This is PHP code, not something flying the space shuttle, you can know it's safe by having everyone have a look.

Before you sink your half a million into Britcoin you can pay a mere few thousand dollars for an independent security audit of the entire site. If you're a skilled developer then you can conduct your own independent audit.

If you're putting the source code to your exchange online then you get instant respect from developers like myself, it shows that:

1) Britcoin doesn't believe in "security by obscurity", instead they opt for real, actual security along with transparency.
2) Britcoin's code is well written enough for them to state their reputation on it, which they have.
3) Britcoin is giving back to the community, they're not someone in this thing to make a quick buck, but actually proving they will invest in the entire community by starting new exchanges.

Having seen hundreds of proprietary, bespoke applications and hundreds of open source ones, I can say with some confidence that the code quality of open source is usually much higher.

Here is a list of some
http://www.talkgold.com/forum/r331614-.html

Sorry, "Open Source all the way" is simply foolish!
You would get thought code? Maybe, but not quite. Main frame projects do, sidelined projects are normally half-baked with more bugs than you can count.
It also diminishes security (not increases), making it a lottery. By knowing the table structure an attacker by founding an exploitable hole would have quite a fine aim instead of shoot fish from the barrel by attempting to guess which table is which (is it users? accounts? members? the guy is Arab and calls it Al-Accounts? who knows?).
Over Open Source it all relies on the intentions of the one who found the exploitable hole, if is a good fellow will warn about it, otherwise will spread havoc.

Actually the breach @ MtGox was all about letting more people than desirable to have a look in his code, ending up with his db spread over the web.

MY EYES!!!