First thing I thought was "oh let them slide, when you think about big issues, you might slip on some sanitize code".

But then I thought, if you advertise something as "encrypted" and "secure" or more secure than competition, you should get at least basic pentest. It is not cheap to get one and a good one but that kind of XSS would be ruled out...