Edit 1 5/11/2018: Note that this does not mean anything bad for you at all and you can continue using ftdna as normal, it's a fantastic site. Also, there is a possibility that the information I was sent regarding who was supposed to be able to use the API could have been incorrect, see the comments section for an interesting discussion on that. I think that the big takeaway from this post should be if you want to use the API for your company it is worth checking in with ftdna to ensure you have permission to do so.
Edit 2 5/11/2018: I have been looking into it more, and I believe that this is not in fact an issue at all which I am very happy about. I am still confused about why ftdna told me otherwise, and it may be that you are technically still not supposed to use it, but I'm really not sure at this time. Special thanks to the anonymous commenter for clearing things up!
Note: I actually wrote this all the way back on March 12th. I had notified FTDNA of the fact that their API was accessible by the public even before that. I am publishing this now because I feel it is my right/duty. They made the decision not to fix it or notify the public that they can use the API, so I think that somebody should. I'm hoping that this post will perhaps raise awareness about this and make FTDNA make a definitive choice about whether they want their API to be publicly available (which I personally think would be fantastic).
Purpose
This document will serve to explain the process through which I found a security vulnerability in the FTDNA web API, as well as the process I went through in reporting said vulnerability and what I would have done differently if given the chance.
Definitions
Some company names and terms used in this document will undoubtedly be unfamiliar to those reading it. This section will serve to clarify said terms.
