There are probably some hacking angles too, e.g. I wonder if the API will helpfully tell me the contents of https://mybank.com/user/latest-statement.jpg https:/

There are probably some hacking angles too, e.g. I wonder if the API will helpfully tell me the contents of https://mybank.com/user/latest-statement.jpg https://mybank.com/user/latest-statement.jpg or whatever