How I found that anyone with a boarding pass photo can pull full passport numbers, home addresses, children's dates of birth, credit card details, and Known Traveler Numbers for every passenger on a Frontier Airlines booking. Reported March 3rd. Still live 105 days later.
you can transfer data over the internet securely (HTTPS) but still have access to their api and get data you shouldnt be able to get (as they’ve detailed)