Salesforce says Experience Cloud-using customers audit all guest account permissions & enforce a least privilege access model. Change default permissions to private so any guest account access must be #enabled & disable all public #API use so guest accounts can't make unauthenticated API calls.