&gt;  I don&#x27;t even understand what this comment is trying to say. If you use HTTP to communicate between services, and those services are not publicly accessible, the use of HTTP makes it no longer a private interface?<p>Yes - if you make a HTTP call from an app, it can be trivially sniffed. Sniffing HTTP is the first thing a third party trying to discover that undocumented API would do, and you don&#x27;t need source code for that at all. (This is also why you must always sanitize data coming in from a user&#x27;s device, even if it&#x27;s from your own app.)<p>You can make the argument that there would be a time cost cleaning up the internal calls that will no longer work once the servers are turned off. Sure, but: 1) there are no secrets that would give competitors a new advantage, and 2) if you don&#x27;t have that time, just chuck the code over the fence and see what happens - worst is that no one uses it, which will be the case with closed code anyway.