Hacker News Reader

Attack surface is another one I use.

Yes, I've always heard it used in this context. I really believe the other use is because someone misheard "service", and it stuck.

That's rather funny! Probably true. "API surface" sounds exactly like a CEO trying to say "API service" without understanding what an API is. lol.