If an attacker can figure out what sites it can be used on, they can use the API.