Possible unauthenticated GET for Settings API call getContactOptionTypes

First, I should point out that I can’t reproduce this issue right now. There’s been too much work-around, and it might’ve been corrected in the past few days.

The issue is that I found an unvalidated endpoint during research to prove the SAK as entered is valid

$result = $settingsApi->getContactOptionTypes();

I’m pretty sure I was calling this with an empty or invalid SAK. Since then, I’ve modified my function signatures to prevent empty/NULL SAK values being sent in the request.
When the call succeeded with an invalid SAK, I added the following line to check the return result, which was a single value, “Prospect”. None of my usable App Ids have a single value for Contact Type, which is why I wrote the following test:
return (sizeof($result->getOptionTypes()) > 1);

I think this issue might’ve been corrected as part of a release the past few days. I’m not having an easy time reproducing this before posting this question. Still, I think it’s an important data point.
I assume I’ll be replacing this test with the Is Application Enabled test.

Thank you for reporting this and for sharing the context, we will look into it.