why are `internal` articles available thru API?

Hey @fluca1978 ,

if you are authenticated as an agent it should display internal articles. As a customer it should not. If you have any evidence of a security issue, you should not share it in the community → security@zammad.com

Thanks!