> So are we saying that they're vulnerable sites?

Not necessarily, if all their API responses are top-level JSON objects.