What security concerns are there with a Suitelet that is externally available or available without login?

AI generated answer (using internal Slack threads):

****** Disclaimer: This response was generated by an artificial intelligence assistant based on previous conversations from multiple Slack channels, and may contain inaccuracies or mistakes. ****** When a Suitelet is made "available without login" or externally available, it means that anyone with the URL can access it, regardless of whether they have a NetSuite account or not. This raises several security concerns: 1. Data Exposure: Since the Suitelet is accessible without login, any data that it retrieves and displays could potentially be viewed by anyone who has the URL. This could include sensitive business data, depending on what the Suitelet is designed to do. 2. Lack of Access Control: There are no additional permission settings that can restrict who can access the Suitelet when it is available without login. The permissions settings on the Suitelet will only impact what that Suitelet can do within your NetSuite environment, not who can access it. 3. Potential for Abuse: Without any form of authentication or access control, the Suitelet could potentially be abused by malicious actors. For example, they could attempt to overload the Suitelet with requests, or use it as a vector for attacks against your NetSuite environment. To mitigate these risks, you could implement some form of external authentication within the Suitelet using your own identity platform. Alternatively, you could validate the IP address for the inbound request before any code gets executed and require an "API key" of sorts that can get validated by the Suitelet code. However, these configurations are not native to NetSuite and would need to be implemented by your development team.