I was reviewing an AI product last month — a Node/Express backend serving an LLM-powered chat interface, streaming responses, handling file uploads for RAG, the works. The prompt engineering was solid. Rate limiting on the model calls was solid. Then I ran curl -I against the API and got back a …