True, someone can get access to this file and download your db.

But you can edit the api for it not to output the download link in the text file. It's quite secure now, what do you think?

obviously, the following line is doing this output (it's for the updated api):
PHP Code: 
open(O,">>rsapiuploads.txt") or die "Unable to save to rsapiuploads.txt: $!\n"; 
he should also add a command to delete the backup db on the server after uploading it else those backup would take lot of disk space