> We spent a significant amount of time on Google's registry software and discovered an endpoint that we believe are not supposed to be accessed without authentication

Can you send me info on this to mcilwain@google.com ? Thanks.