Is it safe to expose keto "read"/"public" port?

[nmapx]

Is it safe?
Assuming that it's running behind firewall, gateway and proxy but still - publicly accessible.
What worries me is the expand endpoint which might leak some confidential data when accessed with specific parameters.
Please advise.

[vinckr]

Hello @nmapx
While Ory Keto implements all Go best practices around running public-facing production HTTP servers, it is generally discouraged to have Ory Keto facing the public net directly. Even though it's behind a firewall, gateway, and proxy, it's recommended to run Ory Keto behind an API gateway or a load balancer for additional security.
Specifically, it's a good practice not to expose the Write API at all to the public internet. The Read API should also be protected as depending on your use case, it can reveal sensitive information (for example, who has permission to do something).