Insights from API security