Not any more than any other public endpoint service exposes. This revocation endpoint can be protected by auth too. Use API key that you're revoking in auth.