Penetration test of new API endpoints