Kestrel
tcp/443
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549293c5c5040a52e36925a7fb631d980ec50249853
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /Auth/login
GET /Auth/logout
GET /api/ApplicationConfig
GET /api/HealthCheck
GET /api/Profile
GET /api/ResponsePack/missed
GET /api/ResponsePack/pack/{id}
GET /api/ResponsePack/{id}
GET /api/SignOff
GET /api/SignOff/cachedCorrectiveActions/{packResponseId}
GET /api/SignOff/correctiveActions
GET /api/SignOff/{id}
GET /api/StoreSelector
GET /api/StoreSelector/checkCurrentStore
GET /api/User
GET /api/User/currentStore
GET /api/User/currentStoreInfo
GET /api/UserAccess/getCached
POST /api/CheckResponse/completeCheck
POST /api/CheckResponse/explainMissed
POST /api/Notification/callback
POST /api/Notification/notify
POST /api/Notification/subscribe
POST /api/Notification/unsubscribe
POST /api/SignOff/cachedCorrectiveActions
PUT /api/SignOff/areaManager
PUT /api/SignOff/storeManager
PUT /api/UserAccess/clearCached
Open service 2.17.100.225:443 · checkflow-dev.icelanddev.net
2026-01-08 23:26
HTTP/1.1 200 OK
Content-Type: text/html
Server: Kestrel
Accept-Ranges: bytes
ETag: "1dbfca7fd7b0ccb"
Last-Modified: Thu, 24 Jul 2025 14:33:58 GMT
request-context: appId=cid-v1:cac6332b-2ea0-4fa4-b51f-adaf318c8088
X-Akamai-Transformed: 9 971 0 pmb=mRUM,1
Date: Thu, 08 Jan 2026 23:26:29 GMT
Content-Length: 4071
Connection: close
Set-Cookie: acaAffinity="647652a3ab1eccb7"; Path=/; HttpOnly; SameSite=None; Secure;
Server-Timing: cdn-cache; desc=MISS
Server-Timing: edge; dur=284
Server-Timing: origin; dur=47
Feature-Policy: accelerometer 'self'; camera 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'self'
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Origin: SAMEORIGIN
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: upgrade-insecure-requests
Server-Timing: ak_p; desc="1767914789387_34694332_791625392_33111_7699_154_187_-";dur=1
Page title: Checkflow
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<link rel="icon" href="/favicon.ico">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<base href="/" />
<title>Checkflow</title>
<!-- Google Fonts -->
<link href="https://fonts.gstatic.com" rel="preconnect">
<link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i|Nunito:300,300i,400,400i,600,600i,700,700i|Poppins:300,300i,400,400i,500,500i,600,600i,700,700i" rel="stylesheet">
<script type="module" crossorigin src="/assets/index-BmWAYG1J.js"></script>
<link rel="stylesheet" crossorigin href="/assets/index-CfAnnMKu.css">
<link rel="manifest" href="/manifest.webmanifest">
<script>!function(a){var e="https://s.go-mpulse.net/boomerang/",t="addEventListener";if("False"=="True")a.BOOMR_config=a.BOOMR_config||{},a.BOOMR_config.PageParams=a.BOOMR_config.PageParams||{},a.BOOMR_config.PageParams.pci=!0,e="https://s2.go-mpulse.net/boomerang/";if(window.BOOMR_API_key="TXHXJ-6U82K-ZRZE3-XCLWE-WJGCR",function(){function n(e){a.BOOMR_onload=e&&e.timeStamp||(new Date).getTime()}if(!a.BOOMR||!a.BOOMR.version&&!a.BOOMR.snippetExecuted){a.BOOMR=a.BOOMR||{},a.BOOMR.snippetExecuted=!0;var i,_,o,r=document.createElement("iframe");if(a[t])a[t]("load",n,!1);else if(a.attachEvent)a.attachEvent("onload",n);r.src="javascript:void(0)",r.title="",r.role="presentation",(r.frameElement||r).style.cssText="width:0;height:0;border:0;display:none;",o=document.getElementsByTagName("script")[0],o.parentNode.insertBefore(r,o);try{_=r.contentWindow.document}catch(O){i=document.domain,r.src="javascript:var d=document.open();d.domain='"+i+"';void(0);",_=r.contentWindow.document}_.open()._l=function(){var a=this.createElement("script");if(i)this.domain=i;a.id="boomr-if-as",a.src=e+"TXHXJ-6U82K-ZRZE3-XCLWE-WJGCR",BOOMR_lstart=(new Date).getTime(),this.body.appendChild(a)},_.write("<bo"+'dy onload="document._l();">'),_.close()}}(),"".length>0)if(a&&"performance"in a&&a.performance&&"function"==typeof a.performance.setResourceTimingBufferSize)a.performance.setResourceTimingBufferSize();!function(){if(BOOMR=a.BOOMR||{},BOOMR.plugins=BOOMR.plugins||{},!BOOMR.plugins.AK){var e=""=="true"?1:0,t="",n="tx24zticcfsoc2lahusq-f-d280a8782-clientnsv4-s.akamaihd.net",i="false"=="true"?2:1,_={"ak.v":"39","ak.cp":"1512864","ak.ai":parseInt("960969",10),"ak.ol":"0","ak.cr":154,"ak.ipv":4,"ak.proto":"http/1.1","ak.rid":"2f2f3eb0","ak.r":40736,"ak.a2":e,"ak.m":"","ak.n":"essl","ak.bpcip":"157.245.204.0","ak.cport":49616,"ak.gh":"2.17.100.188","ak.quicv":"","ak.tlsv":"tls1.3","ak.0rtt":"","ak.0rtt.ed":"","ak.csrc":"-","ak.acc":"bbr","ak.t":"1767914789","ak.ak":"hOBiQwZUYzCg5VSAfCLimQ==+cjptiBQaiXRmf6RwwGfXOWpzsDDQxWeBqvsj7RQXgm1X6Vl8L4qWm6pQWlFjT1UHrZuvYw/Lco7jwinCtHkM7NtCnd6+BpjF9l6kJi+3/fl958CqsFhnqj09pLbxQHmIVrdRbozeGKjWCiRzMxdUjzMt5JMqR94R+u9n2mLc3fgark4Y2GHpF7i6MTq9pAPtA2xoLSV6UJ4asSc/VFgyg5jKWD0luHqko0bd7lJ9EMLd2reZK1tH4SJnc2TRZOgBqNJpzZeN5yu/x7fQ29TizwvybjIEq2yunorNyv6ZgaFYYukc3kDtKQcDiLXR/bKotmIEKKatr4rks6UxOISvzUkX5rO/3m5y5SmMgN1Ma8k4hBnCyHlp9aFhZkgooF7uoFyPmPfZ4qe5L5ReOgoptU35CwaPHefz0aJWrAQ7YE=","ak.pv":"1","ak.dpoabenc":"","ak.tf":i};if(""!==t)_["ak.ruds"]=t;var o={i:!1,av:function(e){var t="http.initiator";if(e&&(!e[t]||"spa_hard"===e[t]))_["ak.feo"]=void 0!==a.aFeoApplied?1:0,BOOMR.addVar(_)},rv:function(){var a=["ak.bpcip","ak.cport","ak.cr","ak.csrc","ak.gh","ak.ipv","ak.m","ak.n","ak.ol","ak.proto","ak.quicv","ak.tlsv","ak.0rtt","ak.0rtt.ed","ak.r","ak.acc","ak.t","ak.tf"];BOOMR.removeVar(a)}};BOOMR.plugins.AK={akVars:_,akDNSPreFetchDomain:n,init:function(){if(!o.i){var a=BOOMR.subscribe;a("before_beacon",o.av,null,null),a("onbeacon",o.rv,null,null),o.i=!0}return this},is_complete:function(){return!0}}}}()}(window);</script></head>
<body>
<div id="app"></div>
<script>
if ('serviceWorker' in navigator) {
navigator.serviceWorker.register(
'/sw-1.0.0.js'
);
}
</script>
</body>
</html>
Open service 2.17.100.225:443 · checkflow-dev.icelanddev.net
2026-01-01 22:09
HTTP/1.1 200 OK
Content-Type: text/html
Server: Kestrel
Accept-Ranges: bytes
ETag: "1dbfca7fd7b0ccb"
Last-Modified: Thu, 24 Jul 2025 14:33:58 GMT
request-context: appId=cid-v1:cac6332b-2ea0-4fa4-b51f-adaf318c8088
X-Akamai-Transformed: 9 971 0 pmb=mRUM,1
Date: Thu, 01 Jan 2026 22:09:07 GMT
Content-Length: 4069
Connection: close
Set-Cookie: acaAffinity="83aef511d05b8674"; Path=/; HttpOnly; SameSite=None; Secure;
Server-Timing: cdn-cache; desc=MISS
Server-Timing: edge; dur=16
Server-Timing: origin; dur=36
Feature-Policy: accelerometer 'self'; camera 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'self'
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Origin: SAMEORIGIN
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: upgrade-insecure-requests
Server-Timing: ak_p; desc="1767305347561_34694357_143947736_5425_8153_167_194_-";dur=1
Page title: Checkflow
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<link rel="icon" href="/favicon.ico">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<base href="/" />
<title>Checkflow</title>
<!-- Google Fonts -->
<link href="https://fonts.gstatic.com" rel="preconnect">
<link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i|Nunito:300,300i,400,400i,600,600i,700,700i|Poppins:300,300i,400,400i,500,500i,600,600i,700,700i" rel="stylesheet">
<script type="module" crossorigin src="/assets/index-BmWAYG1J.js"></script>
<link rel="stylesheet" crossorigin href="/assets/index-CfAnnMKu.css">
<link rel="manifest" href="/manifest.webmanifest">
<script>!function(a){var e="https://s.go-mpulse.net/boomerang/",t="addEventListener";if("False"=="True")a.BOOMR_config=a.BOOMR_config||{},a.BOOMR_config.PageParams=a.BOOMR_config.PageParams||{},a.BOOMR_config.PageParams.pci=!0,e="https://s2.go-mpulse.net/boomerang/";if(window.BOOMR_API_key="TXHXJ-6U82K-ZRZE3-XCLWE-WJGCR",function(){function n(e){a.BOOMR_onload=e&&e.timeStamp||(new Date).getTime()}if(!a.BOOMR||!a.BOOMR.version&&!a.BOOMR.snippetExecuted){a.BOOMR=a.BOOMR||{},a.BOOMR.snippetExecuted=!0;var i,_,o,r=document.createElement("iframe");if(a[t])a[t]("load",n,!1);else if(a.attachEvent)a.attachEvent("onload",n);r.src="javascript:void(0)",r.title="",r.role="presentation",(r.frameElement||r).style.cssText="width:0;height:0;border:0;display:none;",o=document.getElementsByTagName("script")[0],o.parentNode.insertBefore(r,o);try{_=r.contentWindow.document}catch(O){i=document.domain,r.src="javascript:var d=document.open();d.domain='"+i+"';void(0);",_=r.contentWindow.document}_.open()._l=function(){var a=this.createElement("script");if(i)this.domain=i;a.id="boomr-if-as",a.src=e+"TXHXJ-6U82K-ZRZE3-XCLWE-WJGCR",BOOMR_lstart=(new Date).getTime(),this.body.appendChild(a)},_.write("<bo"+'dy onload="document._l();">'),_.close()}}(),"".length>0)if(a&&"performance"in a&&a.performance&&"function"==typeof a.performance.setResourceTimingBufferSize)a.performance.setResourceTimingBufferSize();!function(){if(BOOMR=a.BOOMR||{},BOOMR.plugins=BOOMR.plugins||{},!BOOMR.plugins.AK){var e=""=="true"?1:0,t="",n="t5azasaccfsoc2kw6cbq-f-6bbcee524-clientnsv4-s.akamaihd.net",i="false"=="true"?2:1,_={"ak.v":"39","ak.cp":"1512864","ak.ai":parseInt("960969",10),"ak.ol":"0","ak.cr":167,"ak.ipv":4,"ak.proto":"http/1.1","ak.rid":"89477d8","ak.r":40736,"ak.a2":e,"ak.m":"","ak.n":"essl","ak.bpcip":"159.65.144.0","ak.cport":40030,"ak.gh":"2.17.100.213","ak.quicv":"","ak.tlsv":"tls1.3","ak.0rtt":"","ak.0rtt.ed":"","ak.csrc":"-","ak.acc":"bbr","ak.t":"1767305347","ak.ak":"hOBiQwZUYzCg5VSAfCLimQ==ypCJsZznTYap1kQrHO23xx07Il/y+9CUqbUmT93AvPGJXX5Qp05+bsb2a7nI6afpXk//MTvsfGX4f3RR7bQPdMlvnss7ecxrnbbN1yKRGZ5WMvTlhiVfVK4uuZa1BHTfRbyqP0GOOD7HmRLt19cgJ1wLnyaSUEuCXN068l1lPGlcX82QHBZltcjOXtSXlEeltM6sd1Bd8wrhuf1kY40S7rqi0I2RS8zyrZBp/FM72M/3mXFd2pPhw8KZA84WHMyJg1XKoBNnCyP8ltiGfvVMbFTqBReMgDYUyVav49NIUYlzplpTgXOPh+s/o3pl5Z5IrfjkHuiqg+mPvkxVENIUF8BIsjZaXqzAuB3YafiK4VUggytSSugLvlyd5Iqq+yO5eb2v3hTiMz63pAYj/vmk/0GuVmulkH9h6xU/hWZafy0=","ak.pv":"1","ak.dpoabenc":"","ak.tf":i};if(""!==t)_["ak.ruds"]=t;var o={i:!1,av:function(e){var t="http.initiator";if(e&&(!e[t]||"spa_hard"===e[t]))_["ak.feo"]=void 0!==a.aFeoApplied?1:0,BOOMR.addVar(_)},rv:function(){var a=["ak.bpcip","ak.cport","ak.cr","ak.csrc","ak.gh","ak.ipv","ak.m","ak.n","ak.ol","ak.proto","ak.quicv","ak.tlsv","ak.0rtt","ak.0rtt.ed","ak.r","ak.acc","ak.t","ak.tf"];BOOMR.removeVar(a)}};BOOMR.plugins.AK={akVars:_,akDNSPreFetchDomain:n,init:function(){if(!o.i){var a=BOOMR.subscribe;a("before_beacon",o.av,null,null),a("onbeacon",o.rv,null,null),o.i=!0}return this},is_complete:function(){return!0}}}}()}(window);</script></head>
<body>
<div id="app"></div>
<script>
if ('serviceWorker' in navigator) {
navigator.serviceWorker.register(
'/sw-1.0.0.js'
);
}
</script>
</body>
</html>
Open service 2.17.100.225:443 · checkflow-dev.icelanddev.net
2025-12-23 01:47
HTTP/1.1 200 OK
Content-Type: text/html
Server: Kestrel
Accept-Ranges: bytes
ETag: "1dbfca7fd7b0ccb"
Last-Modified: Thu, 24 Jul 2025 14:33:58 GMT
request-context: appId=cid-v1:cac6332b-2ea0-4fa4-b51f-adaf318c8088
X-Akamai-Transformed: 9 971 0 pmb=mRUM,1
Date: Tue, 23 Dec 2025 01:47:24 GMT
Content-Length: 4067
Connection: close
Set-Cookie: acaAffinity="58db74628f54b923"; Path=/; HttpOnly; SameSite=None; Secure;
Server-Timing: cdn-cache; desc=MISS
Server-Timing: edge; dur=14
Server-Timing: origin; dur=10
Feature-Policy: accelerometer 'self'; camera 'self'; geolocation 'none'; gyroscope 'none'; magnetometer 'none'; microphone 'none'; payment 'none'; usb 'self'
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
Access-Control-Allow-Origin: SAMEORIGIN
Strict-Transport-Security: max-age=31536000
Content-Security-Policy: upgrade-insecure-requests
Server-Timing: ak_p; desc="1766454444080_34694365_461512816_2427_7146_0_7_-";dur=1
Page title: Checkflow
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<link rel="icon" href="/favicon.ico">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<base href="/" />
<title>Checkflow</title>
<!-- Google Fonts -->
<link href="https://fonts.gstatic.com" rel="preconnect">
<link href="https://fonts.googleapis.com/css?family=Open+Sans:300,300i,400,400i,600,600i,700,700i|Nunito:300,300i,400,400i,600,600i,700,700i|Poppins:300,300i,400,400i,500,500i,600,600i,700,700i" rel="stylesheet">
<script type="module" crossorigin src="/assets/index-BmWAYG1J.js"></script>
<link rel="stylesheet" crossorigin href="/assets/index-CfAnnMKu.css">
<link rel="manifest" href="/manifest.webmanifest">
<script>!function(a){var e="https://s.go-mpulse.net/boomerang/",t="addEventListener";if("False"=="True")a.BOOMR_config=a.BOOMR_config||{},a.BOOMR_config.PageParams=a.BOOMR_config.PageParams||{},a.BOOMR_config.PageParams.pci=!0,e="https://s2.go-mpulse.net/boomerang/";if(window.BOOMR_API_key="TXHXJ-6U82K-ZRZE3-XCLWE-WJGCR",function(){function n(e){a.BOOMR_onload=e&&e.timeStamp||(new Date).getTime()}if(!a.BOOMR||!a.BOOMR.version&&!a.BOOMR.snippetExecuted){a.BOOMR=a.BOOMR||{},a.BOOMR.snippetExecuted=!0;var i,_,o,r=document.createElement("iframe");if(a[t])a[t]("load",n,!1);else if(a.attachEvent)a.attachEvent("onload",n);r.src="javascript:void(0)",r.title="",r.role="presentation",(r.frameElement||r).style.cssText="width:0;height:0;border:0;display:none;",o=document.getElementsByTagName("script")[0],o.parentNode.insertBefore(r,o);try{_=r.contentWindow.document}catch(O){i=document.domain,r.src="javascript:var d=document.open();d.domain='"+i+"';void(0);",_=r.contentWindow.document}_.open()._l=function(){var a=this.createElement("script");if(i)this.domain=i;a.id="boomr-if-as",a.src=e+"TXHXJ-6U82K-ZRZE3-XCLWE-WJGCR",BOOMR_lstart=(new Date).getTime(),this.body.appendChild(a)},_.write("<bo"+'dy onload="document._l();">'),_.close()}}(),"".length>0)if(a&&"performance"in a&&a.performance&&"function"==typeof a.performance.setResourceTimingBufferSize)a.performance.setResourceTimingBufferSize();!function(){if(BOOMR=a.BOOMR||{},BOOMR.plugins=BOOMR.plugins||{},!BOOMR.plugins.AK){var e=""=="true"?1:0,t="",n="rjcfefyccfsoc2kj6swa-f-f9ba6408a-clientnsv4-s.akamaihd.net",i="false"=="true"?2:1,_={"ak.v":"39","ak.cp":"1512864","ak.ai":parseInt("960969",10),"ak.ol":"0","ak.cr":0,"ak.ipv":4,"ak.proto":"http/1.1","ak.rid":"1b822070","ak.r":40736,"ak.a2":e,"ak.m":"","ak.n":"essl","ak.bpcip":"138.68.82.0","ak.cport":34868,"ak.gh":"2.17.100.221","ak.quicv":"","ak.tlsv":"tls1.3","ak.0rtt":"","ak.0rtt.ed":"","ak.csrc":"-","ak.acc":"bbr","ak.t":"1766454444","ak.ak":"hOBiQwZUYzCg5VSAfCLimQ==98CoBDd60nIjXLOlmvr1HXErRtbst5qczfd0V7+p8Ci7+W070V7ArP0TNuIZ1pDfo92dONzWl2mVp26u4lQsxPCcR89a7q3naQBmEtJTbyEL1fYdV1zsNnZ80Mm9CLEbegOGUBNyAkErezT8fC1DM7mszW+FLMII/qrG3SijrkVxT/zzLrQOoXrb3cfYSWKO4JI0UwDa9OnKT/9DTjTs2i8S+1gAyo6CWzAjaBbmVNzns5JbfzTbgK7fcSV/ML2liy2vY0HHjp78TOUtlUjQTGhM58Xjf7kwPmyiPjdpr0ZsaHSsveXO7gmUyle0xNk7Djx1ip9GpAkcDfFfRwYdWcHkXFhN9oRLs6wRH1l/vbsXu7LTHa1rBHUvAS4N/SVlZ0J3fC6TQtwYx5WZLNP9Dcg9yOtps2BSHsm7C4FlTEw=","ak.pv":"1","ak.dpoabenc":"","ak.tf":i};if(""!==t)_["ak.ruds"]=t;var o={i:!1,av:function(e){var t="http.initiator";if(e&&(!e[t]||"spa_hard"===e[t]))_["ak.feo"]=void 0!==a.aFeoApplied?1:0,BOOMR.addVar(_)},rv:function(){var a=["ak.bpcip","ak.cport","ak.cr","ak.csrc","ak.gh","ak.ipv","ak.m","ak.n","ak.ol","ak.proto","ak.quicv","ak.tlsv","ak.0rtt","ak.0rtt.ed","ak.r","ak.acc","ak.t","ak.tf"];BOOMR.removeVar(a)}};BOOMR.plugins.AK={akVars:_,akDNSPreFetchDomain:n,init:function(){if(!o.i){var a=BOOMR.subscribe;a("before_beacon",o.av,null,null),a("onbeacon",o.rv,null,null),o.i=!0}return this},is_complete:function(){return!0}}}}()}(window);</script></head>
<body>
<div id="app"></div>
<script>
if ('serviceWorker' in navigator) {
navigator.serviceWorker.register(
'/sw-1.0.0.js'
);
}
</script>
</body>
</html>