  etsyApiFetch(endpoint, options) {
     this._assumeField('endpoint', endpoint);
     return new Promise((resolve, reject) => {
         const getQueryString = queryString.stringify(this.getOptions(options));
         fetch(`${this.apiUrl}${endpoint}?${getQueryString}`)
           .then(response => EtsyClient._response(response, resolve, reject))
           .catch(reject);
     });
  }

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.