ah, hah! It's not! But I thought it was too!  `$apiProperties` is a static array that I create above this code. I updated the code block so that it shows this (and so it looks less like a vulnerability).