GraphQL introspection is enabled.
This could leak to data leak if not properly configured.
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa35dbae3f985cbb59b1e224fb2a54862d8681596b6
GraphQL introspection enabled at /graphql Types: 334 (by kind: ENUM: 75, INPUT_OBJECT: 61, OBJECT: 187, SCALAR: 9, UNION: 2) Operations: - Query: Query | fields: allIngestionStats, availablePDPBlocks, buyersGuide, canRegisterDevice, chartAverageSaleValueRecords - Mutation: Mutation | fields: abortPaymentRequest, addProductsToProductGroup, aiGenerateBuyersGuide, aiGenerateBuyersGuideContext, aiGenerateBuyersGuideQuestions - Subscription: Subscription | fields: buyersGuideAiGenerationStatusUpdated, buyersGuideContextStatusUpdated, buyersGuideProductTaggingStatusUpdated, buyersGuideQuestionsStatusUpdated, organisationSyncStatusUpdated Directives: deprecated, include, oneOf, skip, specifiedBy (total: 5)
Severity: medium
Fingerprint: c2db3a1c40d490db1a0bbaa39b66b5d42f1cee18b7c58fa931eba92ffaee3761
GraphQL introspection enabled at /graphql Types: 336 (by kind: ENUM: 75, INPUT_OBJECT: 60, OBJECT: 190, SCALAR: 9, UNION: 2) Operations: - Query: Query | fields: allIngestionStats, availablePDPBlocks, buyersGuide, canRegisterDevice, chartAverageSaleValueRecords - Mutation: Mutation | fields: abortPaymentRequest, addProductsToProductGroup, aiGenerateBuyersGuide, aiGenerateBuyersGuideContext, aiGenerateBuyersGuideQuestions - Subscription: Subscription | fields: buyersGuideAiGenerationStatusUpdated, buyersGuideContextStatusUpdated, buyersGuideProductTaggingStatusUpdated, buyersGuideQuestionsStatusUpdated, organisationSyncStatusUpdated Directives: deprecated, include, oneOf, skip, specifiedBy (total: 5)
Open service 20.90.134.24:80 · development.managerapi.cloudshelf.ai
2026-01-10 23:10
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Sat, 10 Jan 2026 23:11:54 GMT Location: https://development.managerapi.cloudshelf.ai/
Open service 20.90.134.24:443 · development.managerapi.cloudshelf.ai
2026-01-10 23:10
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Sat, 10 Jan 2026 23:11:56 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KEN2WFWP0VZRTW1ZD19NGMX2
X-Version-Number: v3.195.2-development+0e58479 (development)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}
Open service 20.90.134.35:443 · managerapi.cloudshelf.ai
2026-01-09 21:50
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Fri, 09 Jan 2026 21:51:52 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KEJBX5EP7PJPZZWFGVSZ6FWW
X-Version-Number: v3.194.0 (production)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}
Open service 20.90.134.35:443 · managerapi.cloudshelf.ai
2026-01-02 16:37
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Fri, 02 Jan 2026 16:37:14 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KDZS412YFH2ZV2B2Y196WBEB
X-Version-Number: v3.194.0 (production)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}
Open service 20.90.134.35:443 · managerapi.cloudshelf.ai
2025-12-30 14:29
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Tue, 30 Dec 2025 14:29:13 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KDQTKF3QH99B8ZF509VEFA23
X-Version-Number: v3.194.0 (production)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}
Open service 20.90.134.35:443 · managerapi.cloudshelf.ai
2025-12-23 04:47
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Tue, 23 Dec 2025 04:47:30 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KD4RH8PYBG7P8YTV7ANVW7C7
X-Version-Number: v3.192.4 (production)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}
Open service 20.90.134.35:443 · managerapi.cloudshelf.ai
2025-12-20 15:52
HTTP/1.1 404 Not Found
Content-Length: 63
Connection: close
Content-Type: application/json; charset=utf-8
Date: Sat, 20 Dec 2025 15:52:24 GMT
Access-Control-Allow-Credentials: true
Access-Control-Expose-Headers: x-request-id,x-version-number
ETag: W/"3f-BunLb98SCK6azHy0RO08GDnFBek"
Vary: Origin, Accept-Encoding
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Content-Security-Policy: default-src 'self';script-src 'self' 'unsafe-inline' https://*.apollographql.com https://unpkg.com;style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;img-src 'self' data: https:;connect-src 'self' https://*.lottiefiles.com;font-src 'self' https: data:;object-src 'none';media-src 'self';frame-src 'self' https://*.apollographql.com;base-uri 'self';form-action 'self';frame-ancestors 'self';script-src-attr 'none';upgrade-insecure-requests
Cross-Origin-Opener-Policy: same-origin
Cross-Origin-Resource-Policy: same-origin
Origin-Agent-Cluster: ?1
Referrer-Policy: strict-origin-when-cross-origin
X-Content-Type-Options: nosniff
X-DNS-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 0
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=(), interest-cohort=()
X-Request-ID: gid://cloudshelf/Request/01KCY7CK7Y1MN79R5V989M9HNA
X-Version-Number: v3.192.4 (production)
{"message":"Cannot GET /","error":"Not Found","statusCode":404}