https://blog.0xrobiul.me/2022/03/hidden-api-functionality-exposure.html