Hi, I'm the CEO of Smartcar. While I can't go into exact details, I can say from what we know so far: this occurred out of their main headquarters.
For what it's worth, the usage here means "from within."
Can you confirm that more of their API other than the authorization code was duplicated? Honestly duplicating auth APIs are perfectly fine. If you showed proof of business APIs being duplicated, I'd have more faith in your claim. Right now this looks like a publicity stunt on a baseless argument.
You don't get to say this.