  Blindspots in APIs can cause software engineers to introduce vulnerabilities,
but such blindspots are, unfortunately, common. We study the effect APIs with
blindspots have on developers in two languages by replicating an 109-developer,
24-Java-API controlled experiment. Our replication applies to Python and
involves 129 new developers and 22 new APIs. We find that using APIs with
blindspots statistically significantly reduces the developers' ability to
correctly reason about the APIs in both languages, but that the effect is more
pronounced for Python. Interestingly, for Java, the effect increased with
complexity of the code relying on the API, whereas for Python, the opposite was
true. Whether the developers considered API uses to be more difficult, less
clear, and less familiar did not have an effect on their ability to correctly
reason about them. Developers with better long-term memory recall were more
likely to correctly reason about APIs with blindspots, but short-term memory,
processing speed, episodic memory, and memory span had no effect. Surprisingly,
professional experience and expertice did not improve the developers' ability
to reason about APIs with blindspots across both languages, with long-term
professionals with many years of experience making mistakes as often as
relative novices. Finally, personality traits did not significantly affect the
Python developers' ability to reason about APIs with blindspots, but less
extraverted and more open developers were better at reasoning about Java APIs
with blindspots. Overall, our findings suggest that blindspots in APIs are a
serious problem across languages, and that experience and education alone do
not overcome that problem, suggesting that tools are needed to help developers
recognize blindspots in APIs as they write code that uses those APIs.
