A security researcher discovered their unique email address, used exclusively for BrowserStack, was leaked to Apollo.io, a data broker platform. After signing up for BrowserStack's Open Source program and corresponding with support, the researcher received an unsolicited email from someone claiming to have obtained their details from Apollo.io. When questioned, Apollo initially claimed their "proprietary algorithm" derived the address from public information.

Upon further investigation, Apollo admitted the email came directly from BrowserStack through their "customer contributor network," where businesses share contact data with Apollo's platform. The data collection date was listed as February 25, 2026. Despite multiple attempts to contact BrowserStack about this apparent privacy violation, the company failed to respond to inquiries about selling or sharing user data with third parties.

The incident raises serious questions about BrowserStack's data handling practices and privacy commitments. The researcher suggests several possibilities: BrowserStack may routinely sell user data, a third-party service could be siphoning information, or an insider might be exfiltrating data. This breach of trust, combined with BrowserStack's complete silence when confronted, demonstrates a troubling disregard for user privacy that could have broader implications for anyone who has shared their information with the platform.