some of the worst API security ive EVER seen