API exfiltration is a common technique. One of the downsides of public APIs is that they're usually very enumerable on purpose. This leaks into how we design private APIs as well.

Others could be more traditional, like a dragnet that infiltrates common applications or exploits, then hunts for IAM credentials or a DB server.

Users checking tokens with public endpoints into repositories is also very common.

Also, the term is post-quantum cryptography. I don't think it can be declared quantum-safe or quantum-proof just yet.