One problem could be JWT. Anybody can use the bearer tokens from the portal and then use K6 to flood any endpoint. If you are willing to pay for the attack which states often do.