Request without Authorization token in header are processed

This suggests that ✨ Implement OAuth2 authentication for API endpoints related to code components Active 's test coverage was incomplete/inadequate!?

This is lacking sufficiently precise information though, because the Authorization header is needed ONLY by the CLI tool — not when using the XB UI.

Also: your screenshot shows a 404 — can you please test by pointing at an actually existing js_component? A 404 is not access bypass, not even information disclosure.

So: can you please clarify? 🙏