Use compiler directives to hide test code

Instead of this:

[HttpGet]
public string Test()
{
    return "Hello";
}

Try doing this:

#if DEBUG
[HttpGet]
public string Test()
{
    return "Hello";
}
#endif

Advantage: the code will only be used in Debug (not Release) builds. Of course, if you’re not paying attention to build types, it won’t help. But it has a shot at keeping your test code out of production.