Did a diff on the API2:2019 and API2:2023 and noticed a specific change: _A public-facing API is vulnerable if it:_ I would argue that public-facing is not necessary and applies to all types of APIs and would therefore recommend removing 'public-facing'.