Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1aad03549ac9b2cf16ae02d11e300e87c9513e4829e3761cb
Public Swagger UI/API detected at path: /swagger/index.html - sample paths:
GET /api/Cashiers/{cashierNo}/verifyPasswordValidity
GET /api/Users
GET /api/Users/{username}
GET /api/usernotifications/{username}
POST /api/Cashiers/{cashierNo}/changePassword
POST /api/UserWithPin/activate/{azureAdTenantId}
PUT /api/usernotifications/{username}/dismiss
PUT /api/usernotifications/{username}/{id}/dismiss