and one could also say that it's the job of the producer of the API to set safe and secure defaults for an API :)