API security vulnerabilities