Walk me through your process for investigating a suspected credential stuffing attack on a public-facing API at Klaviyo.
