I would not be surprised if this is intentional. The Are.na REST API is extremely permissive too.
https://www.are.na/are-na/powered-by-are-na
https://www.are.na/are-na/powered-by-are-na