Because nobody trusts APIs before you frisk them