Internal API Documentation Exposure

Detects internal API documentation, admin endpoints, and developer tools accidentally exposed in production.

zakirkun Updated

File contents

Internal API Documentation Exposure

Overview

Development and debugging endpoints left enabled in production:

  • /actuator (Spring Boot) — exposes heap dumps, metrics, environment
  • /debug — application debugging interface
  • /admin/docs — internal API documentation
  • /phpinfo.php — PHP configuration disclosure
  • /__debug__ — Django debug toolbar
  • /robots.txt referencing sensitive paths

Remediation

  • Disable or require authentication for all admin and debug endpoints
  • Use environment guards: if (process.env.NODE_ENV !== 'production')
  • Configure framework-specific settings to disable development tools in production

zakirkun/ice-tea/tree/main/skills/api/api-documentation-exposure commit 60be6b8f6b

Frequently asked questions

npx skillmds@latest add zakirkun/internal-api-documentation-exposure