API VULNERABILITIES