Every piece here is a measurement we ran ourselves, published with
its method, its sample and its code, so you can re-run it and tell
us we are wrong. Where we found our own tools at fault, that is in
the write-up too — a study that only reports what flatters us is an
advertisement.
Sixty per cent of what we found was not in an API route at all. It was in server actions — files whose names promise a library and deliver a public endpoint.