API vulnerability scanning