API security firm APIsec has confirmed it secured an exposed internal database that was left accessible on the internet without a password for several days, potentially exposing sensitive customer information. The database, which was discovered by cybersecurity research firm UpGuard on March 5, reportedly contained data stretching back to 2018, including names and email addresses of users and employees from APIsec’s corporate clients. 

UpGuard said the unsecured database held detailed insights into the security posture of various APIsec customers—data the company collects while monitoring its clients’ APIs for vulnerabilities. This included sensitive information such as whether multi-factor authentication was enabled for particular accounts. 

UpGuard noted that such details could be valuable to threat actors looking for weaknesses in corporate systems. Initially, APIsec founder Faizel Lakhani downplayed the incident, claiming the database contained only test and debugging data and insisting it was not a production system. 

However, after being presented with evidence by TechCrunch showing the inclusion of real-world customer information and API scan results, Lakhani acknowledged the severity of the issue. He confirmed the database had been exposed due to human error and said it was quickly secured once the company was notified. 

Although Lakhani claimed affected customers were notified, he declined to share a copy of the breach notification and did not clarify whether regulatory authorities, such as state attorneys general, had been informed as required by law.  

UpGuard’s investigation also revealed the presence of private credentials in the exposed dataset, including keys for Amazon Web Services (AWS), as well as login details for Slack and GitHub. While researchers could not verify whether the credentials were active, APIsec later stated they belonged to a former employee and were deactivated two years prior. 

It remains unclear why outdated keys were stored in the database at all. The incident raises concerns about how companies specializing in cybersecurity manage their own internal systems and handle sensitive client data, especially as APIsec advertises services to Fortune 500 companies