Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1b885ff436706f2d2810e19e0ae9711a434017da45c6b1ebc
Public Swagger UI/API detected at path: /swagger.json - sample paths:
DELETE /agreements/{agreementId}/competences/{competenceId}
DELETE /agreements/{agreementId}/reference-numbers/{referenceNumberId}
DELETE /agreements/{agreementId}/tags/{tagType}/{tagId}
GET /orders
POST /api-keys
Open service 13.74.252.44:80 · api.cpot.se
2026-01-05 06:03
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Mon, 05 Jan 2026 06:03:14 GMT Location: https://api.cpot.se/
Open service 13.74.252.44:443 · api.cpot.se
2026-01-05 06:03
HTTP/1.1 404 Not Found
Content-Length: 60
Connection: close
Content-Type: application/json; charset=utf-8
Date: Mon, 05 Jan 2026 06:03:14 GMT
Cache-Control: no-cache
Vary: origin
{"statusCode":404,"error":"Not Found","message":"Not Found"}