It's just an automatically translated schema file from their internal .proto definition. Google relies on real cryptography not security through obscurity. Fur

It's just an automatically translated schema file from their internal .proto definition. Google relies on real cryptography not security through obscurity. Furthermore the discovery endpoint is publicly documented[0] and specifically meant for external users. Nobody internal would read the discovery endpoint: they would just pull up the .proto file through code search. Another observation: from my experience at Google it took multiple weeks of effort fighting against the bureaucracy to be able to expose an API to the public. It's not like an AWS S3 bucket that could just be accidentally public. The team knew this is public and had fought the bureaucracy to make it public. [0]: https://developers.google.com/discovery/v1/getting_started https://developers.google.com/discovery/v1/getting_started