Any way to prevent people from accessing this route? 
I’m using Gatsby + Vercel.
You can choose a different route and also exclude this route in your site map and your robots.txt, but as long as you need plasmic to be able to integrate with the website, there does need to be some accessible endpoint. You can also password protect certain routes with for instance HTTP basic auth.
Should I worry about people getting access to the plasmic project because of this route?
They can’t access the project via this route, because there’s no project ID in the plasmic-host