PASS: 17 API, validation, injection and non-public-file checks.
