Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd110a331ec90335dacfad1df80f11660c518704b4f9ba07afd
Public Swagger UI/API detected at path: /v2/api-docs - sample paths: GET /quote/v1/company-executives/list GET /quote/v1/company-financial-indicator/list GET /quote/v1/company-financial-indicator/list-single-indicator GET /quote/v1/company-income-statement/list GET /quote/v1/company-income-statement/list-single-income-statement GET /quote/v1/company-main-composition/list GET /quote/v1/company-main-composition/list-date GET /quote/v1/company-share-active/list GET /quote/v1/company-share-active/stat GET /quote/v1/indicator/show-indicator-list GET /quote/v1/stoke/generate-k-line GET /quote/v1/trading-date/get-trading-date POST /quote/v1/asset-sheet/detail POST /quote/v1/asset-sheet/list POST /quote/v1/cash-flow/detail POST /quote/v1/cash-flow/list POST /quote/v1/company-executives/get-list POST /quote/v1/corp-action/list POST /quote/v1/financial/get-financial-real POST /quote/v1/fix/backup-1d-partition-data POST /quote/v1/fix/fix-1d-partition-data POST /quote/v1/indicator/drag POST /quote/v1/indicator/edit POST /quote/v1/indicator/k-list POST /quote/v1/indicator/list POST /quote/v1/indicator/reset POST /quote/v1/indicator/setting POST /quote/v1/indicator/style POST /quote/v1/news/get-column-list POST /quote/v1/news/get-info-list POST /quote/v1/stock/get-basic-info POST /quote/v1/stoke/get-basic-info POST /quote/v1/stoke/get-market-status POST /quote/v1/stoke/get-stoke-quote POST /quote/v1/stoke/get-stoke-quote-trend POST /quote/v1/stoke/query-company POST /quote/v1/stoke/query-quota-data POST /quote/v1/stoke/search-by-keyword POST /quote/v1/stoke/supply-quote-data
Severity: info
Fingerprint: 5733ddf49ff49cd110a331ec90335dacfad1df80f11660c518704b4f2c52885c
Public Swagger UI/API detected at path: /v2/api-docs - sample paths: GET /quote/v1/company-executives/list GET /quote/v1/company-financial-indicator/list GET /quote/v1/company-financial-indicator/list-single-indicator GET /quote/v1/company-income-statement/list GET /quote/v1/company-income-statement/list-single-income-statement GET /quote/v1/company-main-composition/list GET /quote/v1/company-main-composition/list-date GET /quote/v1/company-share-active/list GET /quote/v1/company-share-active/stat GET /quote/v1/indicator/show-indicator-list GET /quote/v1/stoke/generate-k-line GET /quote/v1/trading-date/get-trading-date POST /quote/v1/asset-sheet/detail POST /quote/v1/asset-sheet/list POST /quote/v1/cash-flow/detail POST /quote/v1/cash-flow/list POST /quote/v1/company-executives/get-list POST /quote/v1/corp-action/list POST /quote/v1/financial/get-financial-real POST /quote/v1/fix/backup-1d-partition-data POST /quote/v1/fix/fix-1d-partition-data POST /quote/v1/indicator/drag POST /quote/v1/indicator/edit POST /quote/v1/indicator/k-list POST /quote/v1/indicator/list POST /quote/v1/indicator/reset POST /quote/v1/indicator/setting POST /quote/v1/indicator/style POST /quote/v1/news/get-column-list POST /quote/v1/news/get-info-list POST /quote/v1/stoke/get-basic-info POST /quote/v1/stoke/get-market-status POST /quote/v1/stoke/get-stoke-quote POST /quote/v1/stoke/get-stoke-quote-trend POST /quote/v1/stoke/query-company POST /quote/v1/stoke/query-quota-data POST /quote/v1/stoke/search-by-keyword POST /quote/v1/stoke/supply-quote-data
Severity: info
Fingerprint: 5733ddf49ff49cd110a331ec90335dacfad1df80f11660c518704b4f01e1acfd
Public Swagger UI/API detected at path: /v2/api-docs - sample paths: GET /quote/v1/company-executives/list GET /quote/v1/company-financial-indicator/list GET /quote/v1/company-financial-indicator/list-single-indicator GET /quote/v1/company-income-statement/list GET /quote/v1/company-income-statement/list-single-income-statement GET /quote/v1/company-main-composition/list GET /quote/v1/company-main-composition/list-date GET /quote/v1/company-share-active/list GET /quote/v1/company-share-active/stat GET /quote/v1/indicator/show-indicator-list GET /quote/v1/stoke/generate-k-line POST /quote/v1/asset-sheet/detail POST /quote/v1/asset-sheet/list POST /quote/v1/cash-flow/detail POST /quote/v1/cash-flow/list POST /quote/v1/company-executives/get-list POST /quote/v1/corp-action/list POST /quote/v1/financial/get-financial-real POST /quote/v1/fix/backup-1d-partition-data POST /quote/v1/fix/fix-1d-partition-data POST /quote/v1/indicator/drag POST /quote/v1/indicator/edit POST /quote/v1/indicator/k-list POST /quote/v1/indicator/list POST /quote/v1/indicator/reset POST /quote/v1/indicator/setting POST /quote/v1/indicator/style POST /quote/v1/news/get-column-list POST /quote/v1/news/get-info-list POST /quote/v1/stoke/get-market-status POST /quote/v1/stoke/get-stoke-quote POST /quote/v1/stoke/get-stoke-quote-trend POST /quote/v1/stoke/query-company POST /quote/v1/stoke/query-quota-data POST /quote/v1/stoke/search-by-keyword POST /quote/v1/stoke/supply-quote-data
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd110a331ec90335dacfad1df80f11660c518704b4f9ba07afd
Public Swagger UI/API detected at path: /v2/api-docs - sample paths: GET /quote/v1/company-executives/list GET /quote/v1/company-financial-indicator/list GET /quote/v1/company-financial-indicator/list-single-indicator GET /quote/v1/company-income-statement/list GET /quote/v1/company-income-statement/list-single-income-statement GET /quote/v1/company-main-composition/list GET /quote/v1/company-main-composition/list-date GET /quote/v1/company-share-active/list GET /quote/v1/company-share-active/stat GET /quote/v1/indicator/show-indicator-list GET /quote/v1/stoke/generate-k-line GET /quote/v1/trading-date/get-trading-date POST /quote/v1/asset-sheet/detail POST /quote/v1/asset-sheet/list POST /quote/v1/cash-flow/detail POST /quote/v1/cash-flow/list POST /quote/v1/company-executives/get-list POST /quote/v1/corp-action/list POST /quote/v1/financial/get-financial-real POST /quote/v1/fix/backup-1d-partition-data POST /quote/v1/fix/fix-1d-partition-data POST /quote/v1/indicator/drag POST /quote/v1/indicator/edit POST /quote/v1/indicator/k-list POST /quote/v1/indicator/list POST /quote/v1/indicator/reset POST /quote/v1/indicator/setting POST /quote/v1/indicator/style POST /quote/v1/news/get-column-list POST /quote/v1/news/get-info-list POST /quote/v1/stock/get-basic-info POST /quote/v1/stoke/get-basic-info POST /quote/v1/stoke/get-market-status POST /quote/v1/stoke/get-stoke-quote POST /quote/v1/stoke/get-stoke-quote-trend POST /quote/v1/stoke/query-company POST /quote/v1/stoke/query-quota-data POST /quote/v1/stoke/search-by-keyword POST /quote/v1/stoke/supply-quote-data
Severity: info
Fingerprint: 5733ddf49ff49cd110a331ec90335dacfad1df80f11660c518704b4f2c52885c
Public Swagger UI/API detected at path: /v2/api-docs - sample paths: GET /quote/v1/company-executives/list GET /quote/v1/company-financial-indicator/list GET /quote/v1/company-financial-indicator/list-single-indicator GET /quote/v1/company-income-statement/list GET /quote/v1/company-income-statement/list-single-income-statement GET /quote/v1/company-main-composition/list GET /quote/v1/company-main-composition/list-date GET /quote/v1/company-share-active/list GET /quote/v1/company-share-active/stat GET /quote/v1/indicator/show-indicator-list GET /quote/v1/stoke/generate-k-line GET /quote/v1/trading-date/get-trading-date POST /quote/v1/asset-sheet/detail POST /quote/v1/asset-sheet/list POST /quote/v1/cash-flow/detail POST /quote/v1/cash-flow/list POST /quote/v1/company-executives/get-list POST /quote/v1/corp-action/list POST /quote/v1/financial/get-financial-real POST /quote/v1/fix/backup-1d-partition-data POST /quote/v1/fix/fix-1d-partition-data POST /quote/v1/indicator/drag POST /quote/v1/indicator/edit POST /quote/v1/indicator/k-list POST /quote/v1/indicator/list POST /quote/v1/indicator/reset POST /quote/v1/indicator/setting POST /quote/v1/indicator/style POST /quote/v1/news/get-column-list POST /quote/v1/news/get-info-list POST /quote/v1/stoke/get-basic-info POST /quote/v1/stoke/get-market-status POST /quote/v1/stoke/get-stoke-quote POST /quote/v1/stoke/get-stoke-quote-trend POST /quote/v1/stoke/query-company POST /quote/v1/stoke/query-quota-data POST /quote/v1/stoke/search-by-keyword POST /quote/v1/stoke/supply-quote-data
Severity: info
Fingerprint: 5733ddf49ff49cd110a331ec90335dacfad1df80f11660c518704b4f01e1acfd
Public Swagger UI/API detected at path: /v2/api-docs - sample paths: GET /quote/v1/company-executives/list GET /quote/v1/company-financial-indicator/list GET /quote/v1/company-financial-indicator/list-single-indicator GET /quote/v1/company-income-statement/list GET /quote/v1/company-income-statement/list-single-income-statement GET /quote/v1/company-main-composition/list GET /quote/v1/company-main-composition/list-date GET /quote/v1/company-share-active/list GET /quote/v1/company-share-active/stat GET /quote/v1/indicator/show-indicator-list GET /quote/v1/stoke/generate-k-line POST /quote/v1/asset-sheet/detail POST /quote/v1/asset-sheet/list POST /quote/v1/cash-flow/detail POST /quote/v1/cash-flow/list POST /quote/v1/company-executives/get-list POST /quote/v1/corp-action/list POST /quote/v1/financial/get-financial-real POST /quote/v1/fix/backup-1d-partition-data POST /quote/v1/fix/fix-1d-partition-data POST /quote/v1/indicator/drag POST /quote/v1/indicator/edit POST /quote/v1/indicator/k-list POST /quote/v1/indicator/list POST /quote/v1/indicator/reset POST /quote/v1/indicator/setting POST /quote/v1/indicator/style POST /quote/v1/news/get-column-list POST /quote/v1/news/get-info-list POST /quote/v1/stoke/get-market-status POST /quote/v1/stoke/get-stoke-quote POST /quote/v1/stoke/get-stoke-quote-trend POST /quote/v1/stoke/query-company POST /quote/v1/stoke/query-quota-data POST /quote/v1/stoke/search-by-keyword POST /quote/v1/stoke/supply-quote-data
Open service 23.50.131.140:80 · quote.ebsec.com
2026-01-10 00:59
HTTP/1.1 404 Not Found
Content-Type: application/json
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
Access-Control-Max-Age: 1728000
Expires: Sat, 10 Jan 2026 01:00:25 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 10 Jan 2026 01:00:25 GMT
Content-Length: 30
Connection: close
Server-Timing: edge; dur=1
Server-Timing: origin; dur=188
Server-Timing: cdn-cache; desc=MISS
Server-Timing: ak_p; desc="1768006825603_389224204_2823261276_18763_4638_0_0_-";dur=1
{"msg":"Not Found","code":404}
Open service 23.50.131.136:443 · quote.ebsec.com
2026-01-09 19:53
HTTP/1.1 404 Not Found
Content-Type: application/json
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Strict-Transport-Security: max-age=15724800; includeSubDomains
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
Access-Control-Max-Age: 1728000
Content-Length: 30
Expires: Fri, 09 Jan 2026 19:53:39 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 09 Jan 2026 19:53:39 GMT
Connection: close
Server-Timing: cdn-cache; desc=MISS
Server-Timing: edge; dur=631
Server-Timing: origin; dur=5
Alt-Svc: h3=":443"; ma=93600
Server-Timing: ak_p; desc="1767988418831_389224204_2756315032_63495_103305_127_234_-";dur=1
{"msg":"Not Found","code":404}
Open service 23.50.131.140:80 · quote.ebsec.com
2026-01-02 18:55
HTTP/1.1 404 Not Found
Content-Type: application/json
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
Access-Control-Max-Age: 1728000
Content-Length: 30
Expires: Fri, 02 Jan 2026 18:55:49 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 02 Jan 2026 18:55:49 GMT
Connection: close
Server-Timing: cdn-cache; desc=MISS
Server-Timing: edge; dur=182
Server-Timing: origin; dur=7
Server-Timing: ak_p; desc="1767380149411_389224204_1015377740_18929_6547_0_0_-";dur=1
{"msg":"Not Found","code":404}
Open service 23.50.131.136:443 · quote.ebsec.com
2026-01-02 18:06
HTTP/1.1 404 Not Found
Content-Type: application/json
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Strict-Transport-Security: max-age=15724800; includeSubDomains
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
Access-Control-Max-Age: 1728000
Content-Length: 30
Expires: Fri, 02 Jan 2026 18:06:23 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 02 Jan 2026 18:06:23 GMT
Connection: close
Server-Timing: cdn-cache; desc=MISS
Server-Timing: edge; dur=208
Server-Timing: origin; dur=4
Alt-Svc: h3=":443"; ma=93600
Server-Timing: ak_p; desc="1767377183468_389224200_3415400531_21228_6004_99_102_-";dur=1
{"msg":"Not Found","code":404}
Open service 23.50.131.136:443 · quote.ebsec.com
2025-12-23 00:54
HTTP/1.1 404 Not Found
Content-Type: application/json
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Strict-Transport-Security: max-age=15724800; includeSubDomains
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
Access-Control-Max-Age: 1728000
Content-Length: 30
Expires: Tue, 23 Dec 2025 00:54:10 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Tue, 23 Dec 2025 00:54:10 GMT
Connection: close
Server-Timing: cdn-cache; desc=MISS
Server-Timing: edge; dur=537
Server-Timing: origin; dur=6
Alt-Svc: h3=":443"; ma=93600
Server-Timing: ak_p; desc="1766451249498_389224204_1187447768_54185_24463_0_12_-";dur=1
{"msg":"Not Found","code":404}
Open service 23.50.131.140:80 · quote.ebsec.com
2025-12-22 14:19
HTTP/1.1 404 Not Found
Content-Type: application/json
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
Access-Control-Max-Age: 1728000
Expires: Mon, 22 Dec 2025 14:19:42 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Mon, 22 Dec 2025 14:19:42 GMT
Content-Length: 30
Connection: close
Server-Timing: edge; dur=1
Server-Timing: origin; dur=208
Server-Timing: cdn-cache; desc=MISS
Server-Timing: ak_p; desc="1766413182530_389224204_1102407971_20821_4900_149_0_-";dur=1
{"msg":"Not Found","code":404}
Open service 23.50.131.136:443 · quote.ebsec.com
2025-12-20 17:01
HTTP/1.1 404 Not Found
Content-Type: application/json
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Strict-Transport-Security: max-age=15724800; includeSubDomains
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
Access-Control-Max-Age: 1728000
Expires: Sat, 20 Dec 2025 17:01:32 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Sat, 20 Dec 2025 17:01:32 GMT
Content-Length: 30
Connection: close
Server-Timing: edge; dur=1
Server-Timing: origin; dur=192
Server-Timing: cdn-cache; desc=MISS
Alt-Svc: h3=":443"; ma=93600
Server-Timing: ak_p; desc="1766250092117_389224204_781854468_19219_6017_0_11_-";dur=1
{"msg":"Not Found","code":404}
Open service 23.50.131.136:443 · quote.ebsec.com
2025-12-19 07:48
HTTP/1.1 404 Not Found
Content-Type: application/json
Vary: Origin
Vary: Access-Control-Request-Method
Vary: Access-Control-Request-Headers
Strict-Transport-Security: max-age=15724800; includeSubDomains
Access-Control-Allow-Origin: *
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: GET, PUT, POST, DELETE, PATCH, OPTIONS
Access-Control-Allow-Headers: DNT,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
Access-Control-Max-Age: 1728000
Content-Length: 30
Expires: Fri, 19 Dec 2025 07:48:59 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Fri, 19 Dec 2025 07:48:59 GMT
Connection: close
Server-Timing: cdn-cache; desc=MISS
Server-Timing: edge; dur=191
Server-Timing: origin; dur=6
Alt-Svc: h3=":443"; ma=93600
Server-Timing: ak_p; desc="1766130539201_389224200_773705670_19659_5217_11_21_-";dur=1
{"msg":"Not Found","code":404}