Funny how many companies ‘discovered’ (and quickly fixed) serious API issues just before GDPR regulation came into force…