API vulnerability