Can APIs Expose Sensitive Data? Yes - Here's How