Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad0354932d1da5fedc3647a7977e38515e96e12e353a280
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/channels
GET /api/channels/config
GET /api/channels/file/{channel}/{path}
GET /api/totp/qr
POST /api/authentication/invite/accept
POST /api/authentication/invite/query
POST /api/authentication/recover/initiate
POST /api/authentication/recover/password
POST /api/authentication/recover/verify
POST /api/authentication/using/credentials
POST /api/authentication/using/totp
POST /api/channels/get
POST /api/channels/post
POST /api/channels/widget
POST /api/factors/credentials/authenticate
POST /api/factors/credentials/validate
POST /api/totp/activate
POST /api/totp/register