APIs: Security Risk or Canary in the Coalmine?