API security is usually an afterthought, but attackers definitely don’t treat it that way | discoverkit | discoverkit