Does Copilot generate secure API routes?

Copilot frequently generates API routes that lack proper security controls. Common issues include missing authentication middleware, no input validation or sanitization, missing rate limiting, overly permissive CORS configurations, and verbose error responses that leak implementation details. Copilot tends to generate the simplest functional implementation, which means API routes often accept any input and return full database objects without filtering sensitive fields. UNPWNED checks common public API paths for reachability, exposed response data, CORS, rate-limit, and error-disclosure signals. Authentication, authorization, and input-validation logic require API-specific testing or code review.