Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549dc2b52de0bde21126bf4c4c7ba63af154a7bde73
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/subscriptions/plans
GET /api/users/all
GET /api/users/{userId}
GET /api/users/{userId}/balance
GET /api/{userId}/invoices
GET /api/{userId}/transactions
PATCH /api/users/{userId}/notificationsSettings
POST /api/transactions/import/revolut-csv
POST /api/users
POST /api/users/{userId}/subscription/change-plan
POST /api/users/{userId}/subscription/pause
POST /api/users/{userId}/subscription/resume
POST /api/webhooks/lowBalanceNotifications
POST /api/webhooks/wiseAccounting
POST /api/{userId}/transactions/{transactionId}/pdf
PUT /api/users/{userId}/address
Severity: info
Fingerprint: 5733ddf49ff49cd1aad035499d8441ddd5669ede8bf8d82ae52eae3b3c3e0909
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/users/all
GET /api/users/{userId}
GET /api/users/{userId}/balance
GET /api/{userId}/invoices
GET /api/{userId}/transactions
PATCH /api/users/{userId}/notificationsSettings
POST /api/transactions/import/revolut-csv
POST /api/users
POST /api/webhooks/lowBalanceNotifications
POST /api/webhooks/wiseAccounting
POST /api/{userId}/transactions/{transactionId}/pdf
PUT /api/users/{userId}/address
Open service 142.251.141.115:443 · epsiflow-api.epsifund.com
2026-01-10 00:29
HTTP/1.1 404 Not Found x-cloud-trace-context: a5ccac3e2a81de397031027b96b5433f date: Sat, 10 Jan 2026 00:29:58 GMT content-type: text/html server: Google Frontend Content-Length: 0 Connection: close
Open service 2a00:1450:4001:807::2013:80 · epsiflow-api.epsifund.com
2026-01-02 19:43
HTTP/1.1 302 Found location: https://epsiflow-api.epsifund.com/ x-cloud-trace-context: 82efe59ffcd5b1cae85b65f1b201f39b date: Fri, 02 Jan 2026 19:43:19 GMT content-type: text/html server: Google Frontend Content-Length: 0 Connection: close
Open service 2a00:1450:4001:807::2013:443 · epsiflow-api.epsifund.com
2026-01-02 19:43
HTTP/1.1 404 Not Found x-cloud-trace-context: 87ee672715be8456bef4437c94de4fbb date: Fri, 02 Jan 2026 19:43:18 GMT content-type: text/html server: Google Frontend Content-Length: 0 Connection: close
Open service 142.251.141.115:80 · epsiflow-api.epsifund.com
2026-01-02 19:43
HTTP/1.1 302 Found location: https://epsiflow-api.epsifund.com/ x-cloud-trace-context: e4f65771345cca6e8f35587577fe3459 date: Fri, 02 Jan 2026 19:43:18 GMT content-type: text/html server: Google Frontend Content-Length: 0 Connection: close
Open service 142.251.141.115:443 · epsiflow-api.epsifund.com
2026-01-02 19:43
HTTP/1.1 404 Not Found x-cloud-trace-context: 44505248493bf893103c67328f728840 date: Fri, 02 Jan 2026 19:43:17 GMT content-type: text/html server: Google Frontend Content-Length: 0 Connection: close