Heroku
tcp/443
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd151e75e4bf95f2dbc8f5bc4cb9593ccf37d5800b358237ce3
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
GET /v1.0/agents
GET /v1.0/agents/{id}
GET /v1.0/insuranceCompanies
GET /v1.0/insuranceCompanies/{id}
GET /v1.0/policies
GET /v1.0/policies/{id}
GET /v1.0/policiesToPay
GET /v1.0/policyTypes
GET /v1.0/policyTypes/{id}
GET /v1.0/users/me
POST /v1.0/authenticate
POST /v1.0/confirmToken
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd151e75e4bf95f2dbc8f5bc4cb9593ccf37d5800b358237ce3
Public Swagger UI/API detected at path: /v3/api-docs - sample paths:
GET /v1.0/agents
GET /v1.0/agents/{id}
GET /v1.0/insuranceCompanies
GET /v1.0/insuranceCompanies/{id}
GET /v1.0/policies
GET /v1.0/policies/{id}
GET /v1.0/policiesToPay
GET /v1.0/policyTypes
GET /v1.0/policyTypes/{id}
GET /v1.0/users/me
POST /v1.0/authenticate
POST /v1.0/confirmToken
Open service 15.197.129.158:443 · api.rknp.be
2026-01-09 08:16
HTTP/1.1 302 Found
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Language: en-US
Content-Length: 0
Date: Fri, 09 Jan 2026 08:16:19 GMT
Expires: 0
Location: /swagger-ui.html
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Pragma: no-cache
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=ANH35Y%2FLhZ5DMJQjrB%2BMRnX4QJi%2F%2FXmFTwjjK9qpWhY%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1767946579"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=ANH35Y%2FLhZ5DMJQjrB%2BMRnX4QJi%2F%2FXmFTwjjK9qpWhY%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1767946579"
Server: Heroku
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Vary: Accept-Encoding
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 0
Connection: close
Open service 15.197.129.158:443 · api.rknp.be
2026-01-02 12:26
HTTP/1.1 302 Found
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Language: en-US
Content-Length: 0
Date: Fri, 02 Jan 2026 12:26:45 GMT
Expires: 0
Location: /swagger-ui.html
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Pragma: no-cache
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=JTlid1idtIrO3NExGYNqJX9c0z6OkmlkzYWVw5nT95w%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1767356805"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=JTlid1idtIrO3NExGYNqJX9c0z6OkmlkzYWVw5nT95w%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1767356805"
Server: Heroku
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Vary: Accept-Encoding
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 0
Connection: close
Open service 15.197.129.158:443 · api.rknp.be
2025-12-22 18:20
HTTP/1.1 302 Found
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Language: en-US
Content-Length: 0
Date: Mon, 22 Dec 2025 18:20:38 GMT
Expires: 0
Location: /swagger-ui.html
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Pragma: no-cache
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=OTOXAxfQvfpe6yycqR4L2%2F2EQZWiHO2baDxku%2BLgWPk%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1766427638"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=OTOXAxfQvfpe6yycqR4L2%2F2EQZWiHO2baDxku%2BLgWPk%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1766427638"
Server: Heroku
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Vary: Accept-Encoding
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 0
Connection: close
Open service 15.197.129.158:443 · api.rknp.be
2025-12-20 18:50
HTTP/1.1 302 Found
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Language: en-US
Content-Length: 0
Date: Sat, 20 Dec 2025 18:50:09 GMT
Expires: 0
Location: /swagger-ui.html
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Pragma: no-cache
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=tz2aO%2BHXXYkeN3yL7s5N1Av3t2RUKarTrEjnLit4R2E%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1766256609"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=tz2aO%2BHXXYkeN3yL7s5N1Av3t2RUKarTrEjnLit4R2E%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1766256609"
Server: Heroku
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Vary: Accept-Encoding
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 0
Connection: close