https://www.ecomsecurity.org/mitigating-api-security-risks/