I'm looking at the problem through the lens of changing the behaviour of an existing API. If you want to create 'secure' APIs that 'do the right' thing, I'm no

I'm looking at the problem through the lens of changing the behaviour of an existing API. If you want to create 'secure' APIs that 'do the right' thing, I'm not against it. But leave the old stuff around, or mark it deprecated, throwing warnings and errors on compilation even, for possible future removal—don't change it.