Solid question and one that applies across a lot of cross-functional entities. Should I be able to see puppet modules on my content view if I can't see repositories? or should I see puppet modules only if I can view the repository they come from?

This story - http://projects.theforeman.org/issues/5500 should encompass the grander idea that all APIs will be tested and checked for protection.