Just made the concerning discovery that when external data is utilized within an NAC forum, the entire API response from that external data is visible through the built in browser's tracing functionality. I had assumed the only data available from the third party connection was the data actually displayed on the forum, not the entire API response.
Please implement something that will hide, encrypt, or not return the entire response to the end user's browser.