That’s how most external load balancers are built—public by default. They expose endpoints to the open web unless you lock them down yourself. This default configuration is dangerous. It means even test services, staging APIs, and experimental features may be viewable to anyone who finds them.
A Privacy by Default External Load Balancer solves this problem at the root. Instead of relying on you to make something private after you deploy, it starts private. No inbound traffic is allowed unless you explicitly choose to open it. Every listener, every route, every connection is invisible from the outside until you say otherwise.
In practical terms, this means the first time you spin up an external load balancer, it behaves like a closed door. You pick which ports to open. You choose if it’s public or internal-only. Access control is no longer a risky afterthought but the baseline.
For teams that deploy systems across multiple environments, this shift is critical. One misconfigured security group today can lead to leaked data tomorrow. With privacy as the default state, even if you forget a rule or a firewall setting, your services stay dark to unwanted traffic. No accidental exposure. No hidden attack surface.