Captain Compliance experienced a minor incident on June 15, 2026 affecting Customer dashboard (Platform API), lasting –. The incident has been resolved; the full update timeline is below.
Affected components
Update timeline
- resolved Jun 15, 2026, 07:31 PM UTC
Summary In June 2026 a security researcher participating in a bug bounty program reported that several API endpoints could return a record without authentication when a required query parameter was omitted entirely. We validated the report the same day, remediated the underlying cause across all affected endpoints, and verified the fix in production. Our review found no evidence of access by anyone other than the reporting researcher. The small number of customers whose records appeared in the researcher's testing were contacted directly. Reference: SEC-2026-08-01 What happened A set of lookup endpoints accepted an identifier as a query parameter causing the database filter to be dropped rather than rejected, and the query returned unauthenticated records. What was exposed Records included email addresses and internal IDs of client data. The researcher's testing touched records belonging to a small number of live customers. Those customers were notified directly. We have no evidence that any party other than the reporting researcher accessed these endpoints in this way. What we did Immediately, on validating the report: Fixed all affected end points Enabled an exhaustive PenTest suite covering our applicaitons (these now run quarterly along with nightly scans) Rotated and hardened tokens as well as an effected customer IDs. Verified the fix in production against each affected endpoint. Remediation was completed and deployed in June of 2026.