The ApilageAI data breach: what happened and what changed

An attacker stole data from the database of our old PHP site. We are sorry. Students trusted us with their information, and we did not protect it well enough.

What was reported

In January 2026, the security monitoring site Brinztech published an alert about a leaked ApilageAI database. It reported that the data covered more than 1,200 students and included:

• Names, email addresses and phone numbers.
• Student IDs and registration details.
• Chat histories, which it said were stored in plaintext.
• Uploaded images.

If you had an account on the old site

Assume your details may be exposed. Change your password anywhere you reused it, and be careful with messages that mention ApilageAI or quote your personal details. Our guide lists the steps.

What changed

We stopped building on the old code. The current ApilageAI is a new platform written from scratch in Go and SvelteKit, and security was part of the design from the start.

• Passwords are stored only as bcrypt hashes, and only a digest of each long-lived session token is stored.
• Database queries are parameterized to defend against SQL injection.
• Private conversations are checked against the signed-in account on every request.
• Secrets are kept out of the code.
• Every change runs through automated tests, and dependencies are checked for known vulnerabilities.

What has not changed

A new codebase does not make anything unbreakable, and it cannot undo a leak that already happened. AI chats are still stored on our servers and are not end-to-end encrypted. We list these limits on our security page and will keep it up to date.

If you find a security problem, email [email protected] with the subject “Security”.