A browsable API endpoint appears to have exposed personal details for more than 700,000 users, underscoring how quickly weak data controls can turn an ordinary service into a sensitive data source.