composer
The Composer lets an authenticated session make the device issue arbitrary outbound HTTP requests, effectively turning it into a proxy into whatever network it sits on. It is off unless a host opts in; every /api/v1/composer route answers 404 while disabled.