The key in the payload is the headline finding. The second failure is the one that explains why the first mattered: email addresses that applicants had configured as private were not visible on the public-facing interface, and investigators still concluded they could be obtained through AI-based web crawling [7]. Privacy was a rendering decision. The endpoint underneath answered fully to whoever asked, and according to the ministry the encryption key was included in what it answered with [6]. Two controls, both implemented in the presentation layer, and the second is why the first bought nothing.
That is what makes the earlier warning worth reading twice. The concern raised a month before was specifically that applicants' personal information could be structured and exposed through API responses [8]. The government said it had taken immediate action, and did not disclose whether the platform's underlying security architecture had been improved [8]. Those are different statements. "Immediate action" is compatible with hiding a field, rotating a token, or blocking a crawler. None of it moves a key out of a response body.
The published dates do not reconcile cleanly. The account puts the breach in July [2] while the Ministry of SMEs and Startups announced the leak on June 18 [3]. Read the warning as arriving a month before that announcement and it falls around mid-May, which is the only ordering that does not place the warning after the ministry's own disclosure [14]. From the announcement to the July 31 confirmation of cause was 43 days [13]. For those six weeks, the people whose idea summaries and evaluation comments were in the set knew the data had left [3] without knowing it had left in readable form [4].
A note on the record itself. This account of the incident, and the remedy attached to it, are published alongside promotional copy for D.AMO, a commercial platform selling encryption, key management and a control centre [12], with the prescription being a dedicated key management system kept physically or logically separate from the data [11]. The advice is ordinary and correct, and it is also being sold. The underlying finding does not need the pitch: the source's own diagnosis is that hard-coding keys as fixed values in application code, configuration files or databases means the key is exposed by the same access that reaches the data, and that the root cause was an architecture with no real key management in it [15].
For a platform whose stored asset is other people's unbuilt businesses and the state's assessment of them [1], that is the entire control failing while the compliance sentence still reads "the data was encrypted".
