Although you might have done already, it'd be worth contacting Chowbus to report this. There's an email contact in the footer of their homepage; I couldn't initially find a security-related contact address, but they may have one too.