Heroku
tcp/443 tcp/80
GraphQL introspection is enabled.
This could leak to data leak if not properly configured.
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3ab6740d7728c1d05b6b2dfb46636232edf79039e
GraphQL introspection enabled at /graphql Types: 94 (by kind: ENUM: 2, INPUT_OBJECT: 31, OBJECT: 54, SCALAR: 7) Operations: - Query: Query | fields: accessToken, activeCatalogue, adminAccessToken, adminStaff, adminStaffs - Mutation: Mutation | fields: applyBookCouponLetter, approveSelectedBooks, confirmBookOrder, createBookCoupon, createBookCouponPayment Directives: deprecated, include, skip (total: 3)
GraphQL introspection is enabled.
This could leak to data leak if not properly configured.
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa3ab6740d7728c1d05b6b2dfb46636232edf79039e
GraphQL introspection enabled at /graphql Types: 94 (by kind: ENUM: 2, INPUT_OBJECT: 31, OBJECT: 54, SCALAR: 7) Operations: - Query: Query | fields: accessToken, activeCatalogue, adminAccessToken, adminStaff, adminStaffs - Mutation: Mutation | fields: applyBookCouponLetter, approveSelectedBooks, confirmBookOrder, createBookCoupon, createBookCouponPayment Directives: deprecated, include, skip (total: 3)
Open service 35.71.179.82:80 · api.bookkarte.com
2026-01-09 06:07
HTTP/1.1 200 OK
Cache-Control: max-age=0, private, must-revalidate
Content-Type: application/json; charset=utf-8
Etag: W/"c955e57777ec0d73639dca6748560d00"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=XGYpQzO4gENrbt8sowZ%2BWTO8zcUyWD%2B4JwyZpfvDyog%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1767938892"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=XGYpQzO4gENrbt8sowZ%2BWTO8zcUyWD%2B4JwyZpfvDyog%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1767938892"
Server: Heroku
Vary: Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: 23a3a55e-7104-4310-5f4e-48e58bffa2ce
X-Runtime: 0.002275
X-Xss-Protection: 0
Date: Fri, 09 Jan 2026 06:08:12 GMT
Content-Length: 16
Connection: close
{"success":true}
Open service 75.2.60.68:443 · api.bookkarte.com
2026-01-09 02:39
HTTP/1.1 200 OK
Cache-Control: max-age=0, private, must-revalidate
Content-Type: application/json; charset=utf-8
Etag: W/"c955e57777ec0d73639dca6748560d00"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=krEc%2BkrauFU7PSOFLgeNTxGIcASovoa9ux2nebEgeE0%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1767926343"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=krEc%2BkrauFU7PSOFLgeNTxGIcASovoa9ux2nebEgeE0%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1767926343"
Server: Heroku
Vary: Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: 62c68a62-6e73-d72a-8851-1ac12ea918c6
X-Runtime: 0.004402
X-Xss-Protection: 0
Date: Fri, 09 Jan 2026 02:39:03 GMT
Content-Length: 16
Connection: close
{"success":true}
Open service 35.71.179.82:80 · api.bookkarte.com
2026-01-02 04:24
HTTP/1.1 200 OK
Cache-Control: max-age=0, private, must-revalidate
Content-Type: application/json; charset=utf-8
Etag: W/"c955e57777ec0d73639dca6748560d00"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=cZoXpVVuBFkqHEJNbgrIvhJ3vXelCsbLR%2BqG8NpfdBU%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1767327885"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=cZoXpVVuBFkqHEJNbgrIvhJ3vXelCsbLR%2BqG8NpfdBU%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1767327885"
Server: Heroku
Vary: Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: 05bb6246-82eb-dd00-2fb9-1a16eca5b501
X-Runtime: 0.002036
X-Xss-Protection: 0
Date: Fri, 02 Jan 2026 04:24:45 GMT
Content-Length: 16
Connection: close
{"success":true}
Open service 75.2.60.68:443 · api.bookkarte.com
2026-01-02 00:33
HTTP/1.1 200 OK
Cache-Control: max-age=0, private, must-revalidate
Content-Type: application/json; charset=utf-8
Etag: W/"c955e57777ec0d73639dca6748560d00"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=iKi1NLqoZzbAp%2BC48VMPeFJx3C%2BTWb%2FxjVjw%2BopwPDU%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1767313996"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=iKi1NLqoZzbAp%2BC48VMPeFJx3C%2BTWb%2FxjVjw%2BopwPDU%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1767313996"
Server: Heroku
Vary: Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: 59549ea9-838b-9434-a9fd-fb66fbb0ef98
X-Runtime: 0.002821
X-Xss-Protection: 0
Date: Fri, 02 Jan 2026 00:33:16 GMT
Content-Length: 16
Connection: close
{"success":true}
Open service 75.2.60.68:443 · api.bookkarte.com
2025-12-30 08:13
HTTP/1.1 200 OK
Cache-Control: max-age=0, private, must-revalidate
Content-Type: application/json; charset=utf-8
Etag: W/"c955e57777ec0d73639dca6748560d00"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=LSNG76%2FGtmcLF%2BZi1h0ubLiSVFe%2BwYz9WVrxq1tKiTo%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1767082392"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=LSNG76%2FGtmcLF%2BZi1h0ubLiSVFe%2BwYz9WVrxq1tKiTo%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1767082392"
Server: Heroku
Vary: Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: d0378947-8b88-0734-3c6d-6fd59df97797
X-Runtime: 0.001992
X-Xss-Protection: 0
Date: Tue, 30 Dec 2025 08:13:12 GMT
Content-Length: 16
Connection: close
{"success":true}
Open service 75.2.60.68:443 · api.bookkarte.com
2025-12-22 23:11
HTTP/1.1 200 OK
Cache-Control: max-age=0, private, must-revalidate
Content-Type: application/json; charset=utf-8
Etag: W/"c955e57777ec0d73639dca6748560d00"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=n5SxIfBdV5ifhc554sHX%2FEyzHaSW56pbQKhenE9Qa7s%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1766445083"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=n5SxIfBdV5ifhc554sHX%2FEyzHaSW56pbQKhenE9Qa7s%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1766445083"
Server: Heroku
Vary: Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: 106dc923-e99f-0097-8e33-b7070a507c0a
X-Runtime: 0.003604
X-Xss-Protection: 0
Date: Mon, 22 Dec 2025 23:11:23 GMT
Content-Length: 16
Connection: close
{"success":true}
Open service 35.71.179.82:80 · api.bookkarte.com
2025-12-22 19:12
HTTP/1.1 200 OK
Cache-Control: max-age=0, private, must-revalidate
Content-Type: application/json; charset=utf-8
Etag: W/"c955e57777ec0d73639dca6748560d00"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=0ZmFDk8ctwUhZvmi%2FdedcdfrYgMOTmoj8JNrUG1jOYg%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1766430745"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=0ZmFDk8ctwUhZvmi%2FdedcdfrYgMOTmoj8JNrUG1jOYg%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1766430745"
Server: Heroku
Vary: Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: 0d65fe55-763f-2df5-56c1-18026061f468
X-Runtime: 0.002087
X-Xss-Protection: 0
Date: Mon, 22 Dec 2025 19:12:25 GMT
Content-Length: 16
Connection: close
{"success":true}
Open service 75.2.60.68:443 · api.bookkarte.com
2025-12-21 01:59
HTTP/1.1 200 OK
Cache-Control: max-age=0, private, must-revalidate
Content-Type: application/json; charset=utf-8
Etag: W/"c955e57777ec0d73639dca6748560d00"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=4pIETzJMNXb760Yl1sje974t1BjxP5pdGWHSJDV%2Ffig%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1766282374"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=4pIETzJMNXb760Yl1sje974t1BjxP5pdGWHSJDV%2Ffig%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1766282374"
Server: Heroku
Vary: Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: 922ed3f4-d039-17cc-e24d-58d9dddaa3d7
X-Runtime: 0.001754
X-Xss-Protection: 0
Date: Sun, 21 Dec 2025 01:59:34 GMT
Content-Length: 16
Connection: close
{"success":true}
Open service 35.71.179.82:80 · api.bookkarte.com
2025-12-20 19:23
HTTP/1.1 200 OK
Cache-Control: max-age=0, private, must-revalidate
Content-Type: application/json; charset=utf-8
Etag: W/"c955e57777ec0d73639dca6748560d00"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=5hoJYRyOErr5Y0RgErf8G8OXyU0HiUJQ7mVAxohdmhI%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1766258594"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=5hoJYRyOErr5Y0RgErf8G8OXyU0HiUJQ7mVAxohdmhI%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1766258594"
Server: Heroku
Vary: Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: fe263623-7398-a385-e61b-59087ac7bd7f
X-Runtime: 0.002042
X-Xss-Protection: 0
Date: Sat, 20 Dec 2025 19:23:14 GMT
Content-Length: 16
Connection: close
{"success":true}
Open service 35.71.179.82:80 · api.bookkarte.com
2025-12-19 02:15
HTTP/1.1 200 OK
Cache-Control: max-age=0, private, must-revalidate
Content-Type: application/json; charset=utf-8
Etag: W/"c955e57777ec0d73639dca6748560d00"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: strict-origin-when-cross-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=6ML%2FU5lqYu5e6Ap7Pcx4e671UF2ktEjKAv%2B5GtGeGQ0%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1766110522"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=6ML%2FU5lqYu5e6Ap7Pcx4e671UF2ktEjKAv%2B5GtGeGQ0%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1766110522"
Server: Heroku
Vary: Origin
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Permitted-Cross-Domain-Policies: none
X-Request-Id: d3d24fa8-8f21-ba0b-4293-9a383e5b9f6b
X-Runtime: 0.002140
X-Xss-Protection: 0
Date: Fri, 19 Dec 2025 02:15:22 GMT
Content-Length: 16
Connection: close
{"success":true}