LeakIX - Host app.tap-stamp.com

Domain app.tap-stamp.com

United States

AMAZON-02

Software information

Heroku

tcp/443 tcp/80

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 99.83.185.157
Domain: app.tap-stamp.com
Port: 443
URL: https://app.tap-stamp.com

First seen 2025-11-07 01:27
Last seen 2026-01-09 23:15
Open for 63 days

Severity: info
Fingerprint: 5733ddf49ff49cd1a8bcc6e58b561266599773804ecfac4dca34699caa9fa8d1

Public Swagger UI/API detected at path: /webjars/swagger-ui/index.html - sample paths:
DELETE /api/dashboard/delete
DELETE /api/profile/delete
GET /api/dashboard/card
GET /api/dashboard/clients
GET /api/dashboard/metrics
GET /api/dashboard/settings
GET /api/passes/generate/init/{jwtCardId}
GET /api/passes/generate/{posQrToken}
GET /api/pos/logo/{id}
GET /api/scan/{qrToken}
GET /v1/devices/{deviceLibraryIdentifier}/registrations/{passTypeIdentifier}
GET /v1/passes/{passTypeIdentifier}/{serialNumber}
POST /api/dashboard/activate
POST /api/dashboard/login
POST /api/dashboard/login/biometric
POST /api/dashboard/password/reset
POST /api/dashboard/register
POST /api/device/register
POST /api/login
POST /api/login/biometric
POST /api/login/oauth
POST /api/pos/logo/upload
POST /api/pos/register
POST /api/pos/staff/signup
POST /api/pos/stamps
POST /api/profile/forget
POST /api/register
POST /api/scan/redeem/{qrToken}
POST /v1/devices/{deviceLibraryIdentifier}/registrations/{passTypeIdentifier}/{serialNumber}
POST /v1/log
PUT /api/dashboard/password/update
PUT /api/profile/password
PUT /api/profile/update

Found on 2026-01-09 23:15

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 15.197.253.240
Domain: app.tap-stamp.com
Port: 80
URL: http://app.tap-stamp.com

First seen 2025-11-07 01:27
Last seen 2026-01-09 17:24
Open for 63 days

Severity: info
Fingerprint: 5733ddf49ff49cd1a8bcc6e58b561266599773804ecfac4dca34699caa9fa8d1

Public Swagger UI/API detected at path: /webjars/swagger-ui/index.html - sample paths:
DELETE /api/dashboard/delete
DELETE /api/profile/delete
GET /api/dashboard/card
GET /api/dashboard/clients
GET /api/dashboard/metrics
GET /api/dashboard/settings
GET /api/passes/generate/init/{jwtCardId}
GET /api/passes/generate/{posQrToken}
GET /api/pos/logo/{id}
GET /api/scan/{qrToken}
GET /v1/devices/{deviceLibraryIdentifier}/registrations/{passTypeIdentifier}
GET /v1/passes/{passTypeIdentifier}/{serialNumber}
POST /api/dashboard/activate
POST /api/dashboard/login
POST /api/dashboard/login/biometric
POST /api/dashboard/password/reset
POST /api/dashboard/register
POST /api/device/register
POST /api/login
POST /api/login/biometric
POST /api/login/oauth
POST /api/pos/logo/upload
POST /api/pos/register
POST /api/pos/staff/signup
POST /api/pos/stamps
POST /api/profile/forget
POST /api/register
POST /api/scan/redeem/{qrToken}
POST /v1/devices/{deviceLibraryIdentifier}/registrations/{passTypeIdentifier}/{serialNumber}
POST /v1/log
PUT /api/dashboard/password/update
PUT /api/profile/password
PUT /api/profile/update

Found on 2026-01-09 17:24

Create report

Open service 99.83.185.157:443 · app.tap-stamp.com

2026-01-09 23:15

HTTP/1.1 401 Unauthorized
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Content-Type: application/json
Date: Fri, 09 Jan 2026 23:16:01 GMT
Expires: 0
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Pragma: no-cache
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=uXIs1WbcS04FXB1v4bPbB5V0FPK%2F183KRJy7ckivYbY%3D\u0026sid=812dcc77-0bd0-43b1-a5f1-b25750382959\u0026ts=1768000561"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=uXIs1WbcS04FXB1v4bPbB5V0FPK%2F183KRJy7ckivYbY%3D&sid=812dcc77-0bd0-43b1-a5f1-b25750382959&ts=1768000561"
Server: Heroku
Strict-Transport-Security: max-age=31536000 ; includeSubDomains
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
X-Xss-Protection: 0
Content-Length: 160
Connection: close


{"timestamp":"2026-01-09T23:16:01.221+00:00","status":401,"error":"Unauthorized","message":"Full authentication is required to access this resource","path":"/"}

Found 3 days ago by HttpPlugin

Domain app.tap-stamp.com

United States

Software information

Swagger API description is publicly available

Swagger API description is publicly available

app.tap-stamp.com

app.tap-stamp.com

Domain summary

IP summary