Comment by VerifiedJoseph

Given what the API was returning, I think its safe to assume the database query was written like 'SELECT * FROM Users where username=troyhunt'.