Is it safe to expose boomerang api to public or is it a bug that can be a serious thread to the company