A few years back when I was looking to buy a house, I was interested in how long the property had been on the market. (I was looking in country towns and their outskirts, where six months is a typical time for a property to be on the market; I even saw one or two blocks of land that seemed to have been for sale for at least five or six years.) Few real estate agents tell you this on their websites (though if you ask, they may), and aggregators like domain.com.au and realestate.com.au don’t either. Except sometimes they do, in the markup. My vague recollection (I don’t have the scraping scripts I wrote handy right now, they’re just on my old laptop and backups) is that I found a JSON blob in the realestate.com.au mobile website containing two dates, and that the domain.com.au desktop website fetched a JSON response from an API which happened to contain one date. I ended up deciding that REA’s dates were when the listing was first seen and last updated, and the Domain one was one of those. Neither of these sites were actually displaying this date, but the data was there for me to take and feed into my research.

Careless or unwitting information disclosure from APIs—sometimes sensitive, sometimes not—is a real problem.