If your site collects and stores private information, someone working for you needs to know enough about security to sort the crazies from the real security researchers.