Backend of formflow doens't have any auth check

As I'm going with Vlad over the app we've also seen some serious security issues with the backend. Maybe @Krishan Saini you can give us some insights here. We sort of have 2 backends. One is the api calls of the front-end to the same nextjs instance (what we have under /website). These calls look like this: https://app.getformflow.io/api/get-forms One is everything under formflow-backend, things like https://formflow-backend-production-e7dc8af51069.herokuapp.com/tenants First of all, the idea of 2 backends is wrong from an architecture perspective, but I assume this has been an old decision, we'll have to fix this at some point. The security issue is that any link from formflow-backend is not protected by any authentication. Have we ever had auth protection on routes? This is a problem, because if you know the urls, you can see private data of any user. Here is an example: https://formflow-backend-production-e7dc8af51069.herokuapp.com/tenants I can see all tenants without being logged into app.getformflow.io Or if I have the url of a form, I can see somebody else's form data completely: https://formflow-backend-clerk-preview-9c0ef86fb88c.herokuapp.com/forms/67124c91f6002e086aa82dd7/versions/67124c92f6002e086aa82dd8