I have an MTA deployed to my BTP, it's working great, but I've just realised/found that if I give the URL for the app to anybody, they can all access it without any BTP login...
It's ok, because the app asks for logins to backend systems, so no dat...