If you've published an API on RapidAPI, there's a good chance it has one (or both) of these two holes. 1. Your real backend URL isn't actually secret RapidAPI's gateway is supposed to be the only way to reach your API.
Source: [Dev.to](https://dev.to/josejux/the-two-security-gaps-every-rapidapi-provider-forgets-to-fix-15h2)