Are APIs Overexposed and Under Protected?