You can configure DRF permission classes in the interface definitions, so there's some security.