Excessive data exposure happens when the API client application does not filter the results it gets before returning the data to the user of the application. When APIs send data that is sensitive, the client application should filter the data before forwarding it to the user. Ca