> It really depends on what you want the word "resource" to mean. I once worked with an old API and when a pentest team ran a scanner against it they reported

> It really depends on what you want the word "resource" to mean. I once worked with an old API and when a pentest team ran a scanner against it they reported hundreds of backdoors and malicious code false positives because they were expecting a 400 error rather than an 200 with success=false response body