"Well, let’s say that we wish to remove the ability to transfer money from our bank to other banks as well as the ability to close accounts.[...] You can see th

"Well, let’s say that we wish to remove the ability to transfer money from our bank to other banks as well as the ability to close accounts.[...] You can see that in this response, links for those two actions have been removed from the HTML." This makes me think about server functionality that is not exposed in the web app but it's still there, with potential security implications. An instance of the more generic case of client functionality not being in sync with server functionality of which client-only form validation is another scenario.