The experience_builder.api.config.auto-save.get route returns data of js_component and xb_asset_library entities without any authentication. This has been the case since
🐛
Content authors cannot see components
Active
landed.
Restrict access properly.
n/a
Active
0.0
… to be triaged
I just realized that I meant to open the issue for api.config.get, that's where I originally discovered the problem. I haven't tested api.config.auto-save.get, so let's be sure to check that, too.