Does Combo Blocks support application passwords

Hello.  We recently had a Pentest performed on our website.  We've set our security block all rest API calls except if authenticated.  However, combo blocks does not support this security feature.  Could you please confirm?

Here is some detail from the pen tester:

How to reproduce
Issue the following command within a terminal console:
$ curl --data a https://4comply.io/wp-json/post-grid/v2/get_site_data
{% raw %} { {% endraw
%}"admin_email":"rholder@4thoughtmarketing.com","admin_name":"Richard
Holder","siteurl":"https://4comply.io","siteAdminurl":"https://4comply.
io/wp-admin/"
...
Vulnerability description
An unauthenticated POST request to the /wp-json/post-grid/v2/get_site_data endpoint of a
WordPress site reveals the admin email address. This vulnerability allows an attacker to obtain the email
address of the site's administrator without needing to authenticate, potentially leading to further targeted
attacks.

Risk description
The exposure of the WordPress admin email address is a significant security risk. Attackers can use this
information to launch targeted phishing attacks, social engineering campaigns, or brute-force attacks to
compromise the admin account. Once an attacker gains access to the admin account, they can potentially
take over the entire WordPress site, leading to data breaches, defacement, or further exploitation of the
site and its users.
Recommendation
To mitigate this vulnerability, it is recommended to:
1. Restrict access to the /wp-json/post-grid/v2/get_site_data endpoint to authenticated users
only.
2. Review and update the WordPress and plugin settings to ensure that sensitive information is not
exposed through APIs.
3. Implement additional security measures such as rate limiting, IP whitelisting, and Web Application
Firewalls (WAF) to protect against unauthorized access.
4. Regularly update WordPress and its plugins to the latest versions to benefit from security patches and
improvements