They don't seem to explain how it managed to find this unauthenticated endpoint hosted on Modal's platform.