An endpoint that creates money from nothing is a liability with a URL

My payment API has a dev-deposit endpoint. It funds wallets WITHOUT a real rail deposit — pure test convenience.

Decision: it gets gated out of production builds entirely. Not "protected by admin key." Not "documented as internal." Compiled out. Unreachable.

An endpoint that creates money from nothing is not a feature with access control. It's a liability with a URL.

Audit your own APIs: which of your endpoints would be catastrophic if the auth layer failed open?