Post

web scanner:
submits GET add/?y=alert("hello")&x=alert("hello")
api: HTTP 500, error (or HTTP 400, that isn't even a number)
scanner: Oh! I got 5xx or 4xx! I found a security vulnerability!!!