Skip to main content
All rules

SEC-048

API documentation is public

MediumDefault severity · Security · Secrets, HTTPS and security headers

Last reviewed

Public API documentation such as Swagger UI or an OpenAPI file gives anyone a map of every endpoint, parameter and admin route, and Swagger UI lets them send requests from the browser. Serve docs only in development or behind authentication, and make sure every endpoint in the spec checks authorization on the server.

In apps built with AI tools

Frameworks such as FastAPI serve interactive docs at /docs by default, and many Express and NestJS templates mount Swagger UI without auth. AI agents keep those defaults unless asked.

What it checks

Common Swagger UI, ReDoc and OpenAPI paths (/api-docs/, /docs, /swagger-ui/, /swagger.json, /openapi.json, /v3/api-docs and others) for interactive docs or a machine-readable API spec.

Why it matters

A public API map shows attackers every endpoint, parameter and admin route to try, and Swagger UI lets anyone send requests from the browser.

Recommended fix

Serve API docs only in development, or put them behind authentication. If the API is meant to be public, make sure every listed endpoint checks authorization on the server.

How to verify

Request each listed path on the live site and confirm it returns 404 or 403.

Example fix prompt

Generic prompt (your report adds the evidence)
Please fix this production issue in my app.

Issue SEC-048: API documentation is public
Site: https://your-app.example

First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: Our interactive API docs / OpenAPI spec are publicly reachable at the paths in the evidence. Disable Swagger UI, ReDoc and the spec routes in production (or require an authenticated admin session for them), then list every endpoint in the spec that does not check the session and the caller’s permission on the server, and add those checks.

Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm it returns 404 or 403.

Questions

My API is meant to be public. Is this still a problem?
Public docs are fine for a public API. The risk is when they list internal, admin or account routes, so Defexity rates a small public spec as low.

References