[thirdsight]

Cant say I actually use the API myself but its the job of the consumer of the API to read and understand it properly and test as well :)

[DrJ]

and one could also say that it's the job of the producer of the API to set safe and secure defaults for an API :)

[thirdsight]

Or provide no defaults therefore solving both problems.