LeakIX - Host devapi.jdform.co

Domain devapi.jdform.co

United States

AMAZON-02

Software information

Heroku

tcp/443 tcp/80

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 75.2.60.68
Domain: devapi.jdform.co
Port: 443
URL: https://devapi.jdform.co

First seen 2025-11-12 03:43
Last seen 2026-01-12 02:23
Open for 60 days

Severity: info
Fingerprint: 5733ddf49ff49cd1b885ff43735a0c8c0c9dd0392af40ac279574fb6a1e6e304

Public Swagger UI/API detected at path: /swagger.json - sample paths:
GET /about/
GET /about/download/{doc_id}/
GET /about/{id}/
GET /contributors/
GET /contributors/{user}/
GET /documents/
GET /documents/{id}/
GET /download/{doc_id}/
GET /editor_confirmation/{token}/
GET /editors/
GET /editors/{id}/
GET /law_areas/
GET /law_areas/{id}/
GET /lawyer_confirmation/{token}/
GET /plan_benefits/
GET /plans/
GET /plans/{id}/
GET /resource_types/
GET /resource_types/{id}/
GET /subscriptions/
GET /subscriptions/canceled_message/{subscription_id}/
GET /subscriptions/{id}/
GET /user_credit_card/
GET /users/
GET /users/{id}/
PATCH /change_password/
POST /check_email/
POST /confirmation/{token}/
POST /contact-form/
POST /contributor_confirmation/{user}/
POST /contributor_verification/{token}/
POST /create_editor/
POST /create_lawyer/
POST /credit_cards/
POST /credit_cards_detach/
POST /email_update_confirmation/{token}/
POST /login/
POST /registration/contributor/
POST /registration/user/
POST /request_reset_pass/
POST /reset_pass/
POST /social-signup/
POST /stripe_web_hook/
POST /subscriptions/reactivate/
POST /test_credit_cards/
POST /web-hook/
PUT /admin/update/{user}/
PUT /contributors/update/{user}/
PUT /documents_update/{id}/
PUT /editors/update/{user}/
PUT /users/update/{user}/

Found on 2026-01-12 02:23

Create report

Swagger API description is publicly available

Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.

Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.

While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.

IP: 75.2.60.68
Domain: devapi.jdform.co
Port: 80
URL: http://devapi.jdform.co

First seen 2025-11-12 03:43
Last seen 2026-01-12 02:23
Open for 60 days

Severity: info
Fingerprint: 5733ddf49ff49cd1b885ff43735a0c8c0c9dd0392af40ac279574fb6a1e6e304

Public Swagger UI/API detected at path: /swagger.json - sample paths:
GET /about/
GET /about/download/{doc_id}/
GET /about/{id}/
GET /contributors/
GET /contributors/{user}/
GET /documents/
GET /documents/{id}/
GET /download/{doc_id}/
GET /editor_confirmation/{token}/
GET /editors/
GET /editors/{id}/
GET /law_areas/
GET /law_areas/{id}/
GET /lawyer_confirmation/{token}/
GET /plan_benefits/
GET /plans/
GET /plans/{id}/
GET /resource_types/
GET /resource_types/{id}/
GET /subscriptions/
GET /subscriptions/canceled_message/{subscription_id}/
GET /subscriptions/{id}/
GET /user_credit_card/
GET /users/
GET /users/{id}/
PATCH /change_password/
POST /check_email/
POST /confirmation/{token}/
POST /contact-form/
POST /contributor_confirmation/{user}/
POST /contributor_verification/{token}/
POST /create_editor/
POST /create_lawyer/
POST /credit_cards/
POST /credit_cards_detach/
POST /email_update_confirmation/{token}/
POST /login/
POST /registration/contributor/
POST /registration/user/
POST /request_reset_pass/
POST /reset_pass/
POST /social-signup/
POST /stripe_web_hook/
POST /subscriptions/reactivate/
POST /test_credit_cards/
POST /web-hook/
PUT /admin/update/{user}/
PUT /contributors/update/{user}/
PUT /documents_update/{id}/
PUT /editors/update/{user}/
PUT /users/update/{user}/

Found on 2026-01-12 02:23

Create report

Open service 35.71.179.82:80 · devapi.jdform.co

2026-01-12 02:23

HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Allow: GET, HEAD, OPTIONS
Content-Length: 621
Content-Type: application/json
Cross-Origin-Opener-Policy: same-origin
Date: Mon, 12 Jan 2026 02:24:53 GMT
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Referrer-Policy: same-origin
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=wwnHwdf1bC%2BsLa7UB4tAVYtJ3qaYO1ZAqk15eytj9yI%3D\u0026sid=1b10b0ff-8a76-4548-befa-353fc6c6c045\u0026ts=1768184693"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=wwnHwdf1bC%2BsLa7UB4tAVYtJ3qaYO1ZAqk15eytj9yI%3D&sid=1b10b0ff-8a76-4548-befa-353fc6c6c045&ts=1768184693"
Server: Heroku
Vary: Accept, origin, Cookie
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Frame-Options: DENY
Connection: close


{"users":"http://devapi.jdform.co/users/","editors":"http://devapi.jdform.co/editors/","contributors":"http://devapi.jdform.co/contributors/","about":"http://devapi.jdform.co/about/","resource_types":"http://devapi.jdform.co/resource_types/","law_areas":"http://devapi.jdform.co/law_areas/","documents":"http://devapi.jdform.co/documents/","documents_update":"http://devapi.jdform.co/documents_update/","plans":"http://devapi.jdform.co/plans/","credit_cards":"http://devapi.jdform.co/credit_cards/","test_credit_cards":"http://devapi.jdform.co/test_credit_cards/","subscriptions":"http://devapi.jdform.co/subscriptions/"}

Found 9 hours ago by HttpPlugin

Domain devapi.jdform.co

United States

Software information

Swagger API description is publicly available

Swagger API description is publicly available

devapi.jdform.co

devapi.jdform.co

Domain summary

IP summary