API security vulnerabilties