A server response body contained what looks like a credential (API key, token, or private key). Backends should never hand long-lived secrets to the client.
A backend response body contained what looks like a long-lived credential (an API key or private key). Anyone who can reach that endpoint, or who captures the traffic, extracts a working secret without touching the client binary at all.
Credential compromise straight from the API, usable from an attacker's own infrastructure beyond your rate limits.