Blisk browser devs left an Elasticsearch server exposed online without a password.