insecure API endpoints