Secure misconfiguration

Ensure the product API is locked down appropriately.