Add caution around endpoint security, update fetch code snippet

Author: Xenc5

docs/capabilities/server/http-fetch.mdx

@@ -70,10 +70,14 @@ Client-side fetch has different restrictions and can only make requests to your
 **Client-side restrictions:**
 
 - **Domain limitation**: Can only make requests to your own webview domain
-- **Endpoint requirement**: All requests must target endpoints that end with `/api`
+- **Endpoint requirement**: Client-side fetches to your app server must target paths that start with `/api/`
 - **Authentication**: Handled automatically - no need to manage auth tokens
 - **No external domains**: Cannot make requests to external domains from client-side code
 
+:::caution
+Do not treat `/api/` endpoints as private. Any user who can load your app will be able to call them directly. When changing Redis, content, settings, moderator state, or other persistent data, first check that the user has permission in your server logic. Apps with unprotected endpoints will be rejected during review.
+:::
+
 ```tsx title="client/index.ts"
 const handleFetchData = async () => {
   // Correct: fetching your own webview's API endpoint
@@ -91,7 +95,7 @@ const handleFetchData = async () => {
 // Incorrect: cannot fetch external domains from client-side
 // const response = await fetch('https://external-api.com/data');
 
-// Incorrect: endpoint must end with /api
+// Incorrect: client fetch endpoint must start with /api/
 // const response = await fetch('/user-data');
 ```
 

versioned_docs/version-0.12/capabilities/server/http-fetch.mdx

@@ -70,10 +70,14 @@ Client-side fetch has different restrictions and can only make requests to your
 **Client-side restrictions:**
 
 - **Domain limitation**: Can only make requests to your own webview domain
-- **Endpoint requirement**: All requests must target endpoints that end with `/api`
+- **Endpoint requirement**: Client-side fetches to your app server must target paths that start with `/api/`
 - **Authentication**: Handled automatically - no need to manage auth tokens
 - **No external domains**: Cannot make requests to external domains from client-side code
 
+:::caution
+Do not treat `/api/` endpoints as private. Any user who can load your app will be able to call them directly. When changing Redis, content, settings, moderator state, or other persistent data, first check that the user has permission in your server logic. Apps with unprotected endpoints will be rejected during review.
+:::
+
 ```tsx title="client/index.ts"
 const handleFetchData = async () => {
   // Correct: fetching your own webview's API endpoint
@@ -91,7 +95,7 @@ const handleFetchData = async () => {
 // Incorrect: cannot fetch external domains from client-side
 // const response = await fetch('https://external-api.com/data');
 
-// Incorrect: endpoint must end with /api
+// Incorrect: client fetch endpoint must start with /api/
 // const response = await fetch('/user-data');
 ```
 

versioned_docs/version-0.13/capabilities/server/http-fetch.mdx

@@ -70,10 +70,14 @@ Client-side fetch has different restrictions and can only make requests to your
 **Client-side restrictions:**
 
 - **Domain limitation**: Can only make requests to your own webview domain
-- **Endpoint requirement**: All requests must target endpoints that end with `/api`
+- **Endpoint requirement**: Client-side fetches to your app server must target paths that start with `/api/`
 - **Authentication**: Handled automatically - no need to manage auth tokens
 - **No external domains**: Cannot make requests to external domains from client-side code
 
+:::caution
+Do not treat `/api/` endpoints as private. Any user who can load your app will be able to call them directly. When changing Redis, content, settings, moderator state, or other persistent data, first check that the user has permission in your server logic. Apps with unprotected endpoints will be rejected during review.
+:::
+
 ```tsx title="client/index.ts"
 const handleFetchData = async () => {
   // Correct: fetching your own webview's API endpoint
@@ -91,7 +95,7 @@ const handleFetchData = async () => {
 // Incorrect: cannot fetch external domains from client-side
 // const response = await fetch('https://external-api.com/data');
 
-// Incorrect: endpoint must end with /api
+// Incorrect: client fetch endpoint must start with /api/
 // const response = await fetch('/user-data');
 ```