In case someone is interested, here is a tool which actually (no false positives) detects data leak via your APIs : <a href="https:&#x2F;&#x2F;fallible.co&#x2F;blog&#x2F;&#x2F;2016&#x2F;03&#x2F;13&#x2F;Automating-data-leak-detection&#x2F;" rel="nofollow">https:&#x2F;&#x2F;fallible.co&#x2F;blog&#x2F;&#x2F;2016&#x2F;03&#x2F;13&#x2F;Automating-data-leak-de...</a><p>Tool link: <a href="https:&#x2F;&#x2F;overseer.fallible.co" rel="nofollow">https:&#x2F;&#x2F;overseer.fallible.co</a> (I doubt people will be okay with installing our certificate, but just in case someone wants to use a hosted version)