The API testing firm took down a database exposed to the internet without a password.