Microsoft mitigates Power Platform information disclosure vulnerability

We do a lot of work on power platform and I have had some suspicions around the custom connector "test your code" features as well.

This feature allows you to define an api and run it from a Microsoft server somewhere to validate it works.

What security assumptions are applied to the environment from where these run? Are those assumptions universal?