Live copy of NUMIDENT “lacks any security oversight,” whistleblower alleges.