Internal API Documentation Exposure

Detects internal API documentation, admin endpoints, and developer tools accidentally exposed in production.

zakirkun 60be6b8 2 files · 2.5 KB Updated

File contents

Internal API Documentation Exposure

Overview

Development and debugging endpoints left enabled in production:

  • /actuator (Spring Boot) — exposes heap dumps, metrics, environment
  • /debug — application debugging interface
  • /admin/docs — internal API documentation
  • /phpinfo.php — PHP configuration disclosure
  • /__debug__ — Django debug toolbar
  • /robots.txt referencing sensitive paths

Remediation

  • Disable or require authentication for all admin and debug endpoints
  • Use environment guards: if (process.env.NODE_ENV !== 'production')
  • Configure framework-specific settings to disable development tools in production

zakirkun/ice-tea/tree/main/skills/api/api-documentation-exposure commit 60be6b8f6b

Frequently asked questions

npx skillmds@latest add zakirkun/internal-api-documentation-exposure