How parameter discovery tools find undocumented API inputs in a few dozen requests, why a hit isn't a bug yet, and how to prove impact safely.