That fact that the API hosts are internal seems to be the bulk of the argument against the validity of the claims here. However, internally accessible applicat

That fact that the API hosts are internal seems to be the bulk of the argument against the validity of the claims here. However, internally accessible application servers behind public proxy/proxies is a fairly common pattern...