Internal API Documentation Exposure
Overview
Development and debugging endpoints left enabled in production:
/actuator(Spring Boot) — exposes heap dumps, metrics, environment/debug— application debugging interface/admin/docs— internal API documentation/phpinfo.php— PHP configuration disclosure/__debug__— Django debug toolbar/robots.txtreferencing sensitive paths
Remediation
- Disable or require authentication for all admin and debug endpoints
- Use environment guards:
if (process.env.NODE_ENV !== 'production') - Configure framework-specific settings to disable development tools in production