Profile My skills Saved Collections Edit profile Submit a skill

Swagger / OpenAPI Documentation Exposed in Production

Detects Swagger UI, Redoc, or OpenAPI documentation endpoints accessible without authentication in production.

zakirkun Updated
Docs & Writing

File contents

Swagger / OpenAPI Exposed in Production

Overview

API documentation endpoints expose:

  • Complete API schema including undocumented endpoints
  • Authentication mechanisms and expected formats
  • Example payloads that can be used for fuzzing
  • Internal models and data structures

While useful in development, public Swagger in production gives attackers a full roadmap of the API.

Remediation

  • Restrict Swagger UI to internal networks or authenticated users
  • Disable Swagger in production builds
  • Use NODE_ENV=production check or similar to conditionally serve docs

zakirkun/ice-tea/tree/main/skills/api/swagger-exposed commit d4441a25a8

Browse category

Frequently asked questions

npx skillmds@latest add zakirkun/swagger-openapi-documentation-exposed-in-production