Shadow and Zombie APIs have the potential to open unintended backdoors or expose private information. They WILL creep up when least expected. In this talk, you’ll learn the "What" and "How" of understanding, discovering, and identifying Shadow and Zombie APIs. I'll cover the problem scope, classical solutions, and techniques for popular Web API frameworks (including Express.js and SpringBoot, using Interactive Application Security Testing) that you can employ today to tackle these pesky vulnerabilities. We will explore which approaches are most convenient for attackers and how you can significantly increase the difficulty for any adversary. Additionally, I’ll demo my open-source tool designed to proactively bridge the gap between your API's specifications and what they actually expose.