ajax-enabled wcf service security

 Is an ajax-enabled wcf service reachable to anything other than the web project that is hosting it?
Configuration:

<system.serviceModel>
  <behaviors>
   <endpointBehaviors>
    <behavior name="ServiceAspNetAjaxBehavior">
     <enableWebScript />
    </behavior>
   </endpointBehaviors>
  </behaviors>
  <serviceHostingEnvironment aspNetCompatibilityEnabled="true" />
  <services>
   <service name="Service">
    <endpoint address="" behaviorConfiguration="ServiceAspNetAjaxBehavior"
     binding="webHttpBinding" contract="Service" />
   </service>
  </services>
 </system.serviceMod ...