GraphQL introspection is enabled.
This could leak to data leak if not properly configured.
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa39b66b5d42f1cee18b7c58fa931eba92ffaee3761
GraphQL introspection enabled at /graphql Types: 336 (by kind: ENUM: 75, INPUT_OBJECT: 60, OBJECT: 190, SCALAR: 9, UNION: 2) Operations: - Query: Query | fields: allIngestionStats, availablePDPBlocks, buyersGuide, canRegisterDevice, chartAverageSaleValueRecords - Mutation: Mutation | fields: abortPaymentRequest, addProductsToProductGroup, aiGenerateBuyersGuide, aiGenerateBuyersGuideContext, aiGenerateBuyersGuideQuestions - Subscription: Subscription | fields: buyersGuideAiGenerationStatusUpdated, buyersGuideContextStatusUpdated, buyersGuideProductTaggingStatusUpdated, buyersGuideQuestionsStatusUpdated, organisationSyncStatusUpdated Directives: deprecated, include, oneOf, skip, specifiedBy (total: 5)
Open service 20.90.134.35:80 · beta.ingestapi.cloudshelf.ai
2026-01-12 14:54
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Mon, 12 Jan 2026 14:55:35 GMT Location: https://beta.ingestapi.cloudshelf.ai/
Open service 20.90.134.35:443 · beta.ingestapi.cloudshelf.ai
2026-01-12 14:54
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Mon, 12 Jan 2026 14:55:35 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KESB93CJ5JHHBDK3YW6QCNRM
X-Version-Number: v3.194.0 (production)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}
Open service 20.90.134.35:80 · ingestapi.cloudshelf.ai
2026-01-11 02:40
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Sun, 11 Jan 2026 02:41:26 GMT Location: https://ingestapi.cloudshelf.ai/
Open service 20.90.134.35:443 · ingestapi.cloudshelf.ai
2026-01-11 02:40
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Sun, 11 Jan 2026 02:41:26 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KENEW3Y9E3K6HRFCRTYRE5WE
X-Version-Number: v3.194.0 (production)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}
Open service 20.90.134.24:443 · development.ingestapi.cloudshelf.ai
2026-01-11 01:10
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Sun, 11 Jan 2026 01:11:26 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KEN9Q9JB8RF19KT940CA64VC
X-Version-Number: v3.195.2-development+0e58479 (development)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}
Open service 20.90.134.24:80 · development.ingestapi.cloudshelf.ai
2026-01-11 01:10
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Sun, 11 Jan 2026 01:11:24 GMT Location: https://development.ingestapi.cloudshelf.ai/
Open service 20.90.134.35:443 · ingestapi.cloudshelf.ai
2026-01-09 00:53
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Fri, 09 Jan 2026 00:54:51 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KEG3ZG7JKCZ5XBWQ6744X4DQ
X-Version-Number: v3.194.0 (production)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}
Open service 20.90.134.35:443 · ingestapi.cloudshelf.ai
2026-01-01 23:46
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Thu, 01 Jan 2026 23:46:45 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KDXZ9S29CXZCTABTND3SDNVA
X-Version-Number: v3.194.0 (production)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}
Open service 20.90.134.35:443 · ingestapi.cloudshelf.ai
2025-12-30 10:30
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Tue, 30 Dec 2025 10:30:27 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KDQCY8HAP9X0VB7T61P4XXFZ
X-Version-Number: v3.194.0 (production)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}
Open service 20.90.134.35:443 · ingestapi.cloudshelf.ai
2025-12-22 09:19
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Mon, 22 Dec 2025 09:19:24 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KD2NPDNKSA75N8GT87VRP8YC
X-Version-Number: v3.192.4 (production)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}
Open service 20.90.134.35:443 · ingestapi.cloudshelf.ai
2025-12-20 09:03
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Sat, 20 Dec 2025 09:03:29 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KCXFZV5ZWWFQ3GHGFYJ4RE4Q
X-Version-Number: v3.192.4 (production)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}