Just out of curiosity, have you run into the &quot;how did (our &#x2F; users&#x27;)  (password &#x2F; private key) get into the ABC data record that gets returned on XYZ API call?&quot; regret (even though it&#x27;s not displayed by the GUI, still it&#x27;s transmitted)?<p>I&#x27;m thinking it&#x27;s a total potential for exploit on web apps backed by mongodb and any dynamic language.