[DrJ]

and one could also say that it's the job of the producer of the API to set safe and secure defaults for an API :)

[thirdsight]

Or provide no defaults therefore solving both problems.