Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd12ec8532c2ec8532c2ec8532c2ec8532c2ec8532c2ec8532c
Public Swagger UI/API detected at path: /swagger/index.html
Open service 20.111.1.8:443 · api.dev.i-visual.com
2026-01-12 08:43
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Mon, 12 Jan 2026 08:44:13 GMT
Access-Control-Allow-Credentials: true
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin
request-context: appId=cid-v1:
X-Powered-By: Express
{"message":"Cannot GET /","error":"Not Found","statusCode":404}
Open service 20.111.1.8:80 · api.dev.i-visual.com
2026-01-12 08:43
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Mon, 12 Jan 2026 08:44:12 GMT Location: https://api.dev.i-visual.com/
Open service 13.69.68.45:80 · dev.i-visual.com
2026-01-11 10:19
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Sun, 11 Jan 2026 10:20:45 GMT Location: https://dev.i-visual.com/
Open service 13.69.68.45:443 · dev.i-visual.com
2026-01-11 10:19
HTTP/1.1 308 Permanent Redirect Connection: close Date: Sun, 11 Jan 2026 10:20:45 GMT Location: /ivisual Transfer-Encoding: chunked request-context: appId=cid-v1: Refresh: 0;url=/ivisual /ivisual