If you are using it with the Gateway, it will be easily bypassed with a forward in the controller when you call an api from another api. Thus all security checks are bypassed.