These are possible problems, but they are unique to this pattern. It's worth being aware of these risk of for sure, but they all have may have mitigations: -

These are possible problems, but they are unique to this pattern. It's worth being aware of these risk of for sure, but they all have may have mitigations: - The app may be internal - The API maybe gated by as API gateway, and the new APIs exposed at a later time. - APIs should always be coded to have security in depth, it should not matter if the UI is enabled or not. It's not about delivering changes that are not fully ready to be in production. It's about breaking down a larger change, and delivering it in chunks, as and when each one is fully ready.