Heroku
tcp/443 tcp/80
GraphQL introspection is enabled.
This could leak to data leak if not properly configured.
Severity: medium
Fingerprint: c2db3a1c40d490db2337d3d68cd6ae94e1e57258a781990e60e720bef1fb814a
GraphQL introspection enabled at /api/graphql Types: 30 (by kind: ENUM: 3, OBJECT: 23, SCALAR: 4) Operations: - Query: RootQueryType | fields: catalog, colours, country, products, shipping Directives: deprecated, include, skip (total: 3) Readable stores: 0
Open service 75.2.43.161:443 · products.kite.ly
2026-01-09 04:38
HTTP/1.1 200 OK
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Origin: *
Content-Length: 338
Content-Type: text/html; charset=utf-8
Date: Fri, 09 Jan 2026 04:38:20 GMT
Etag: W/"152-YTy48u1driU58Ip5w36K5lDSM60"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=xuA1pAgIN%2FdNd11ZdGsu3ybEocPVx7c6wSkuBCVrjLg%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1767933500"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=xuA1pAgIN%2FdNd11ZdGsu3ybEocPVx7c6wSkuBCVrjLg%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1767933500"
Server: Heroku
Strict-Transport-Security: max-age=15552000; includeSubDomains
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Dns-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Connection: close
Resources:
<ul>
<li>GraphQL:
<a href="/api/graphql">GraphQL endpoint</a>,
</li>
<li>Version:
<a href="/version.txt">GET version.txt</a>
</li>
<li>
Queue monitoring:
<a href="/arena">
/arena
</a>
</li>
</ul>
Open service 76.223.11.49:80 · products.kite.ly
2026-01-08 00:52
HTTP/1.1 302 Found
Content-Length: 47
Content-Type: text/plain; charset=utf-8
Date: Thu, 08 Jan 2026 00:53:39 GMT
Location: https://products.kite.ly/
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=wM95N7eerEDvAnnYv3I7%2BtreDLDbG3orex1bhp%2Bi3qQ%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1767833619"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=wM95N7eerEDvAnnYv3I7%2BtreDLDbG3orex1bhp%2Bi3qQ%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1767833619"
Server: Heroku
Vary: Accept
Via: 1.1 heroku-router
X-Powered-By: Express
Connection: close
Found. Redirecting to https://products.kite.ly/
Open service 75.2.43.161:80 · products.kite.ly
2026-01-08 00:52
HTTP/1.1 302 Found
Content-Length: 47
Content-Type: text/plain; charset=utf-8
Date: Thu, 08 Jan 2026 00:53:38 GMT
Location: https://products.kite.ly/
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=7lhMDfMFQjkOKl33oEc8hDThhhaVIKTKveygmYuUOnI%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1767833618"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=7lhMDfMFQjkOKl33oEc8hDThhhaVIKTKveygmYuUOnI%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1767833618"
Server: Heroku
Vary: Accept
Via: 1.1 heroku-router
X-Powered-By: Express
Connection: close
Found. Redirecting to https://products.kite.ly/
Open service 15.197.129.158:80 · products.kite.ly
2026-01-08 00:52
HTTP/1.1 302 Found
Content-Length: 47
Content-Type: text/plain; charset=utf-8
Date: Thu, 08 Jan 2026 00:53:39 GMT
Location: https://products.kite.ly/
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=wM95N7eerEDvAnnYv3I7%2BtreDLDbG3orex1bhp%2Bi3qQ%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1767833619"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=wM95N7eerEDvAnnYv3I7%2BtreDLDbG3orex1bhp%2Bi3qQ%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1767833619"
Server: Heroku
Vary: Accept
Via: 1.1 heroku-router
X-Powered-By: Express
Connection: close
Found. Redirecting to https://products.kite.ly/
Open service 75.2.43.161:443 · products.kite.ly
2026-01-08 00:52
HTTP/1.1 200 OK
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Origin: *
Content-Length: 338
Content-Type: text/html; charset=utf-8
Date: Thu, 08 Jan 2026 00:52:37 GMT
Etag: W/"152-YTy48u1driU58Ip5w36K5lDSM60"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=6IIM3gPzDxClle19PLQSsuvphwmacvxRqZjjyuVdL7Y%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1767833557"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=6IIM3gPzDxClle19PLQSsuvphwmacvxRqZjjyuVdL7Y%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1767833557"
Server: Heroku
Strict-Transport-Security: max-age=15552000; includeSubDomains
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Dns-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Connection: close
Resources:
<ul>
<li>GraphQL:
<a href="/api/graphql">GraphQL endpoint</a>,
</li>
<li>Version:
<a href="/version.txt">GET version.txt</a>
</li>
<li>
Queue monitoring:
<a href="/arena">
/arena
</a>
</li>
</ul>
Open service 15.197.129.158:443 · products.kite.ly
2026-01-08 00:52
HTTP/1.1 200 OK
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Origin: *
Content-Length: 338
Content-Type: text/html; charset=utf-8
Date: Thu, 08 Jan 2026 00:52:37 GMT
Etag: W/"152-YTy48u1driU58Ip5w36K5lDSM60"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=6IIM3gPzDxClle19PLQSsuvphwmacvxRqZjjyuVdL7Y%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1767833557"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=6IIM3gPzDxClle19PLQSsuvphwmacvxRqZjjyuVdL7Y%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1767833557"
Server: Heroku
Strict-Transport-Security: max-age=15552000; includeSubDomains
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Dns-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Connection: close
Resources:
<ul>
<li>GraphQL:
<a href="/api/graphql">GraphQL endpoint</a>,
</li>
<li>Version:
<a href="/version.txt">GET version.txt</a>
</li>
<li>
Queue monitoring:
<a href="/arena">
/arena
</a>
</li>
</ul>
Open service 99.83.217.1:443 · products.kite.ly
2026-01-08 00:52
HTTP/1.1 200 OK
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Origin: *
Content-Length: 338
Content-Type: text/html; charset=utf-8
Date: Thu, 08 Jan 2026 00:52:37 GMT
Etag: W/"152-YTy48u1driU58Ip5w36K5lDSM60"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=6IIM3gPzDxClle19PLQSsuvphwmacvxRqZjjyuVdL7Y%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1767833557"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=6IIM3gPzDxClle19PLQSsuvphwmacvxRqZjjyuVdL7Y%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1767833557"
Server: Heroku
Strict-Transport-Security: max-age=15552000; includeSubDomains
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Dns-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Connection: close
Resources:
<ul>
<li>GraphQL:
<a href="/api/graphql">GraphQL endpoint</a>,
</li>
<li>Version:
<a href="/version.txt">GET version.txt</a>
</li>
<li>
Queue monitoring:
<a href="/arena">
/arena
</a>
</li>
</ul>
Open service 76.223.11.49:443 · products.kite.ly
2026-01-08 00:52
HTTP/1.1 200 OK
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Origin: *
Content-Length: 338
Content-Type: text/html; charset=utf-8
Date: Thu, 08 Jan 2026 00:52:37 GMT
Etag: W/"152-YTy48u1driU58Ip5w36K5lDSM60"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=6IIM3gPzDxClle19PLQSsuvphwmacvxRqZjjyuVdL7Y%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1767833557"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=6IIM3gPzDxClle19PLQSsuvphwmacvxRqZjjyuVdL7Y%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1767833557"
Server: Heroku
Strict-Transport-Security: max-age=15552000; includeSubDomains
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Dns-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Connection: close
Resources:
<ul>
<li>GraphQL:
<a href="/api/graphql">GraphQL endpoint</a>,
</li>
<li>Version:
<a href="/version.txt">GET version.txt</a>
</li>
<li>
Queue monitoring:
<a href="/arena">
/arena
</a>
</li>
</ul>
Open service 99.83.217.1:80 · products.kite.ly
2026-01-08 00:52
HTTP/1.1 302 Found
Content-Length: 47
Content-Type: text/plain; charset=utf-8
Date: Thu, 08 Jan 2026 00:53:38 GMT
Location: https://products.kite.ly/
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=7lhMDfMFQjkOKl33oEc8hDThhhaVIKTKveygmYuUOnI%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1767833618"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=7lhMDfMFQjkOKl33oEc8hDThhhaVIKTKveygmYuUOnI%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1767833618"
Server: Heroku
Vary: Accept
Via: 1.1 heroku-router
X-Powered-By: Express
Connection: close
Found. Redirecting to https://products.kite.ly/
Open service 75.2.43.161:443 · products.kite.ly
2026-01-02 12:46
HTTP/1.1 200 OK
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Origin: *
Content-Length: 338
Content-Type: text/html; charset=utf-8
Date: Fri, 02 Jan 2026 12:46:28 GMT
Etag: W/"152-YTy48u1driU58Ip5w36K5lDSM60"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=WF93TXnyfFhDRu%2F7txUUSJKw5h4sR2TZyoCp2o7kWok%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1767357988"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=WF93TXnyfFhDRu%2F7txUUSJKw5h4sR2TZyoCp2o7kWok%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1767357988"
Server: Heroku
Strict-Transport-Security: max-age=15552000; includeSubDomains
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Dns-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Connection: close
Resources:
<ul>
<li>GraphQL:
<a href="/api/graphql">GraphQL endpoint</a>,
</li>
<li>Version:
<a href="/version.txt">GET version.txt</a>
</li>
<li>
Queue monitoring:
<a href="/arena">
/arena
</a>
</li>
</ul>
Open service 75.2.43.161:443 · products.kite.ly
2025-12-30 11:19
HTTP/1.1 200 OK
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Origin: *
Content-Length: 338
Content-Type: text/html; charset=utf-8
Date: Tue, 30 Dec 2025 11:19:54 GMT
Etag: W/"152-YTy48u1driU58Ip5w36K5lDSM60"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=S%2BplUUxt4PffFf9P3cw1DuJoV9%2F0zqeQ1YMtmLNZgz0%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1767093594"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=S%2BplUUxt4PffFf9P3cw1DuJoV9%2F0zqeQ1YMtmLNZgz0%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1767093594"
Server: Heroku
Strict-Transport-Security: max-age=15552000; includeSubDomains
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Dns-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Connection: close
Resources:
<ul>
<li>GraphQL:
<a href="/api/graphql">GraphQL endpoint</a>,
</li>
<li>Version:
<a href="/version.txt">GET version.txt</a>
</li>
<li>
Queue monitoring:
<a href="/arena">
/arena
</a>
</li>
</ul>
Open service 75.2.43.161:443 · products.kite.ly
2025-12-22 12:37
HTTP/1.1 200 OK
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Origin: *
Content-Length: 338
Content-Type: text/html; charset=utf-8
Date: Mon, 22 Dec 2025 12:37:11 GMT
Etag: W/"152-YTy48u1driU58Ip5w36K5lDSM60"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=CZGtjV%2FV8oDq%2Bi197Jq9Gp%2FRN269abe9Rb00VwF6JOs%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1766407031"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=CZGtjV%2FV8oDq%2Bi197Jq9Gp%2FRN269abe9Rb00VwF6JOs%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1766407031"
Server: Heroku
Strict-Transport-Security: max-age=15552000; includeSubDomains
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Dns-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Connection: close
Resources:
<ul>
<li>GraphQL:
<a href="/api/graphql">GraphQL endpoint</a>,
</li>
<li>Version:
<a href="/version.txt">GET version.txt</a>
</li>
<li>
Queue monitoring:
<a href="/arena">
/arena
</a>
</li>
</ul>
Open service 75.2.43.161:443 · products.kite.ly
2025-12-20 09:51
HTTP/1.1 200 OK
Access-Control-Allow-Headers: Origin, X-Requested-With, Content-Type, Accept
Access-Control-Allow-Origin: *
Content-Length: 338
Content-Type: text/html; charset=utf-8
Date: Sat, 20 Dec 2025 09:51:39 GMT
Etag: W/"152-YTy48u1driU58Ip5w36K5lDSM60"
Nel: {"report_to":"heroku-nel","response_headers":["Via"],"max_age":3600,"success_fraction":0.01,"failure_fraction":0.1}
Report-To: {"group":"heroku-nel","endpoints":[{"url":"https://nel.heroku.com/reports?s=uSaTKsEygPtDo3GeD0hAaeQxxCOHjQxUFuP4QSpMS1o%3D\u0026sid=c4c9725f-1ab0-44d8-820f-430df2718e11\u0026ts=1766224299"}],"max_age":3600}
Reporting-Endpoints: heroku-nel="https://nel.heroku.com/reports?s=uSaTKsEygPtDo3GeD0hAaeQxxCOHjQxUFuP4QSpMS1o%3D&sid=c4c9725f-1ab0-44d8-820f-430df2718e11&ts=1766224299"
Server: Heroku
Strict-Transport-Security: max-age=15552000; includeSubDomains
Via: 1.1 heroku-router
X-Content-Type-Options: nosniff
X-Dns-Prefetch-Control: off
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
Connection: close
Resources:
<ul>
<li>GraphQL:
<a href="/api/graphql">GraphQL endpoint</a>,
</li>
<li>Version:
<a href="/version.txt">GET version.txt</a>
</li>
<li>
Queue monitoring:
<a href="/arena">
/arena
</a>
</li>
</ul>