I'm currently working for a real estate startup and I have to seriously twist their arm to convince them we should authenticate private api requests at all, let alone run vulnerability testing.