Kestrel
tcp/443
Exposing Swagger/OpenAPI documentation is primarily a risk if your API has underlying security flaws, as it gives attackers a precise roadmap to find them.
Those detail every endpoint, parameter, and data model, making it easier to discover and exploit vulnerabilities like broken access control or injection points.
While a perfectly secure API mitigates the danger, protecting your documentation is a critical layer of defense that forces attackers to work without a map.
Severity: info
Fingerprint: 5733ddf49ff49cd1f3d88d60b353d3a0251a1e5230890c493cd88c7532636822
Public Swagger UI/API detected at path: /swagger/v1/swagger.json - sample paths:
DELETE /api/webhook/delete/{id}
GET /api/library/districts/{county}
GET /api/library/libraryversion
GET /api/library/{district}
GET /api/reporting/allservices
GET /api/reporting/clientreport
GET /api/reporting/keywordsummary
GET /api/reporting/library
GET /api/reporting/referrals
GET /api/reporting/searchreport
GET /api/reporting/serviceadmins
GET /api/reporting/sitesummary
GET /api/reporting/useractivity
GET /api/reporting/userlogs
GET /api/token/status
GET /api/webhook/all
GET /api/webhook/get/{id}
POST /api/referral/accept/{referralId}
POST /api/referral/addnote
POST /api/referral/close/{referralId}/{reason}
POST /api/referral/create
POST /api/referral/reject/{referralId}/{reason}
POST /api/referral/signpost
POST /api/token/refresh
POST /api/webhook/add
Open service 20.90.134.13:80 · somewherefrontland.codeg.uy
2026-01-11 10:11
HTTP/1.1 301 Moved Permanently Content-Length: 0 Connection: close Date: Sun, 11 Jan 2026 10:12:35 GMT Location: https://somewherefrontland.codeg.uy/
Open service 20.90.134.13:443 · somewherefrontland.codeg.uy
2026-01-11 10:11
HTTP/1.1 200 OK
Connection: close
Content-Type: text/html; charset=utf-8
Date: Sun, 11 Jan 2026 10:12:35 GMT
Server: Kestrel
Cache-Control: no-cache, no-store
Pragma: no-cache
Set-Cookie: .AspNetCore.Antiforgery.grYBoXXHc_M=CfDJ8BxhpLRXFchAreS3RuPngQRMo2eTakXFhqkW2BwlkbLS1TYji4pZWHW5LyjEZ9KDQDIvyfuWbZ5gVaMQ4tvYPJ3ErVlngBUjjPPJSWrmoKfaq3DiuPYYLNpdM66sR12hZcWNn0hHF9igZTpidSqia5A; path=/; secure; samesite=strict; httponly
Transfer-Encoding: chunked
Strict-Transport-Security: max-age=2592000
Request-Context: appId=cid-v1:d4116138-2bfa-4130-b5f7-69d9d64876ed
X-Frame-Options: SAMEORIGIN
X-Content-Type-Options: nosniff
X-XSS-Protection: 1; mode=block
Referrer-Policy: no-referrer
X-Permitted-Cross-Domain-Policies: none
Permissions-Policy: accelerometer=(), camera=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), payment=(), usb=()
Page title: Home Page
<!doctype html>
<html lang="en">
<head>
<script src="https://cdn.userway.org/widget.js" data-account="NP4AD1yzcf"></script>
<meta charset="utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
<title>Home Page</title>
<meta name="description" content="Frontline Home Page">
<meta property="og:title" content="Home Page">
<meta property="og:description" content="Frontline Home Page">
<!-- Google Tag Manager -->
<script>
(function (w, d, s, l, i) {
w[l] = w[l] || []; w[l].push({
'gtm.start':
new Date().getTime(), event: 'gtm.js'
}); var f = d.getElementsByTagName(s)[0],
j = d.createElement(s), dl = l != 'dataLayer' ? '&l=' + l : ''; j.async = true; j.src =
'https://www.googletagmanager.com/gtm.js?id=' + i + dl; f.parentNode.insertBefore(j, f);
})(window, document, 'script', 'dataLayer', '');</script>
<!-- End Google Tag Manager -->
<script type="text/javascript" src="https://maps.googleapis.com/maps/api/js?key=AIzaSyA04NBQK4CvSl8eZaaLqPGiOG_iAElTRM8&libraries=places"></script>
<meta content='width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0' name='viewport' />
<meta name="viewport" content="width=device-width" />
<link href="/css/site.min.css?v=8" type="text/css" rel="stylesheet" />
<link href='https://fonts.googleapis.com/css?family=Roboto:400,700,300' rel='stylesheet' type='text/css'>
<script src="/js/site.min.js?v=6"></script>
<script type="text/javascript" charset="UTF-8">
document.addEventListener('DOMContentLoaded',
function () {
cookieconsent.run({ "notice_banner_type": "headline", "consent_type": "express", "palette": "light", "language": "en", "page_load_consent_levels": ["strictly-necessary"], "notice_banner_reject_button_hide": false, "preferences_center_close_button_hide": false, "page_refresh_confirmation_buttons": false, "website_name": "Frontline", "open_preferences_center_selector": "#open_preferences_center", "website_privacy_policy_url": "/privacy" });
});
</script>
<link rel="apple-touch-icon" sizes="180x180" href="/apple-touch-icon.png">
<link rel="icon" type="image/png" sizes="32x32" href="/favicon-32x32.png">
<link rel="icon" type="image/png" sizes="16x16" href="/favicon-16x16.png">
<link rel="manifest" href="/site.webmanifest">
<link rel="mask-icon" href="/safari-pinned-tab.svg" color="#5bbad5">
<meta name="msapplication-TileColor" content="#ffffff">
<meta name="theme-color" content="#ffffff">
</head>
<body>
<!-- Google Tag Manager (noscript) -->
<noscript>
<iframe src="https://www.googletagmanager.com/ns.html?id="
height="0" width="0" style="display:none;visibility:hidden"></iframe>
</noscript>
<!-- End Google Tag Manager (noscript) -->
<a href="#maincontent" class="text-white noprint">Skip to main content</a>
<div class="container printfullwidth">
<div class="innercontainer">
<div class="site-header noprint mb-4">
<div class="row">
<div class="col-md-6">
<a href="/" title="Somewhere">
<img src="/content/logos/somewhere.svg" class="logo" alt="Somewhere" />
</a>
</div>
<div class="col-md-6">
<div class="row mt-5">
<div class="col access-links float-end">
<ul class="nav float-end">
<li class="item3">
<a title="Library Map" class="item3" href="https://frontland.codeg.uy">Map</a>
</li>
<li class="item2 About"><a title="About" class="item2 About" href="/about">About</a></li>