Discovered the Burmese Pajeet had created an API route 9 months ago that dumped the entire employee database unauthenticated. Even included home address and phone numbers of next of kin.