> an API that should probably be better secured.

I think the API is secured? The entire premise is that a volunteer creates an account and uploads ADS-B telemetry. Detecting falsified data is a separate matter.

Sounds like authentication is working great, but their authorization design may be flawed.