I discovered a possible security hole. You can get request information without a technician key. If you enter the following in a browser you'll see what I mean:

http://itildemo.servicedeskplusmsp.com/sdpapi/request/233?format=json

Regards,

Kerim Berkeveld