Risk: Shared token
API Surface Protection