How to prevent internal API leak? #apisecurity