A visa facilitation service handling UK entry applications has exposed sensitive user data, including passports and selfies, on an openly accessible server, according to a report by TechCrunch.