Just out of curiosity, have you run into the "how did (our / users') (password / private key) get into the ABC data record that gets returned on XYZ API call?"

Just out of curiosity, have you run into the "how did (our / users') (password / private key) get into the ABC data record that gets returned on XYZ API call?" regret (even though it's not displayed by the GUI, still it's transmitted)? I'm thinking it's a total potential for exploit on web apps backed by mongodb and any dynamic language.