Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549d6e5b37747e249be1ac1c9c9b3ca5c5201778341
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /integration/report/File/getfile/{id}
GET /integration/{siteName}/AdHocInspection/Get
GET /integration/{siteName}/WorkOrder/Get
GET /integration/{siteName}/WorkOrder/Get/{id}
GET /integration/{siteName}/WorkOrder/GetWithInspections/{id}
GET /integration/{siteName}/WorkOrder/Inspections/{id}
POST /integration/{siteName}/Tag/Post
POST /integration/{siteName}/WorkOrder/Post
PUT /integration/{siteName}/Tag/Put/{id}
PUT /integration/{siteName}/WorkOrder/Status/{id}
Open service 20.90.134.10:443 · mielectric.test.arnleanexar.com
2026-01-23 13:51
HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Fri, 23 Jan 2026 13:51:53 GMT Location: https://mielectric.test.arnleanexar.com/Identity/Account/Login?ReturnUrl=%2F Set-Cookie: ARRAffinity=a4d101227d49cf21820f38df6571ce6b7ba7648703ab64893ef03e0268160cfa;Path=/;HttpOnly;Secure;Domain=mielectric.test.arnleanexar.com Set-Cookie: ARRAffinitySameSite=a4d101227d49cf21820f38df6571ce6b7ba7648703ab64893ef03e0268160cfa;Path=/;HttpOnly;SameSite=None;Secure;Domain=mielectric.test.arnleanexar.com Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:d763273c-68ea-447e-a22c-6384391e20dc X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: same-origin Content-Security-Policy: font-src 'self' data: default-src 'self' 'unsafe-inline' 'unsafe-eval' ajax.aspnetcdn.com cdnjs.cloudflare.com cdnjs.com kendo.cdn.telerik.com fonts.googleapis.com fonts.gstatic.com; Permissions-Policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=*, payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=*, xr-spatial-tracking=(), clipboard-read=(), clipboard-write=*, gamepad=(), speaker-selection=()
Open service 20.90.134.10:443 · mielectric.test.arnleanexar.com
2026-01-10 06:09
HTTP/1.1 302 Found Content-Length: 0 Connection: close Date: Sat, 10 Jan 2026 06:10:45 GMT Location: https://mielectric.test.arnleanexar.com/Identity/Account/Login?ReturnUrl=%2F Set-Cookie: ARRAffinity=b1ef89074c71e161dc4fc9e1fb894062be585b15fd3db58dcfd3dfb656c73999;Path=/;HttpOnly;Secure;Domain=mielectric.test.arnleanexar.com Set-Cookie: ARRAffinitySameSite=b1ef89074c71e161dc4fc9e1fb894062be585b15fd3db58dcfd3dfb656c73999;Path=/;HttpOnly;SameSite=None;Secure;Domain=mielectric.test.arnleanexar.com Strict-Transport-Security: max-age=2592000 Request-Context: appId=cid-v1:d763273c-68ea-447e-a22c-6384391e20dc X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Referrer-Policy: same-origin Content-Security-Policy: font-src 'self' data: default-src 'self' 'unsafe-inline' 'unsafe-eval' ajax.aspnetcdn.com cdnjs.cloudflare.com cdnjs.com kendo.cdn.telerik.com fonts.googleapis.com fonts.gstatic.com; Permissions-Policy: accelerometer=(), ambient-light-sensor=(), autoplay=(), battery=(), camera=(), cross-origin-isolated=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=*, execution-while-out-of-viewport=*, fullscreen=(), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), navigation-override=*, payment=(), picture-in-picture=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=*, xr-spatial-tracking=(), clipboard-read=(), clipboard-write=*, gamepad=(), speaker-selection=()
Open service 20.90.134.10:80 · mielectric.test.arnleanexar.com
2026-01-10 06:09
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Sat, 10 Jan 2026 06:10:44 GMT Location: https://mielectric.test.arnleanexar.com/