SEC-049
Server metrics endpoint is public
MediumDefault severity · Security · Secrets, HTTPS and security headers
Last reviewed
What it checks
/metrics, /actuator/prometheus and /api/metrics for a Prometheus metrics page.
Why it matters
Metrics reveal internal route names, traffic, error rates, library versions and sometimes user or tenant identifiers in labels, which helps attackers plan and time an attack.
Recommended fix
Serve metrics on an internal port or network only, or require a scrape token.
How to verify
Request each listed path on the live site and confirm it returns 404 or 403.
Example fix prompt
Generic prompt (your report adds the evidence)
Please fix this production issue in my app.
Issue SEC-049: Server metrics endpoint is public
Site: https://your-app.example
First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: The Prometheus metrics endpoint in the evidence is reachable from the public internet. Move it to an internal-only port or route, or require a bearer token that only the metrics scraper has, and confirm the public URL returns 404 or 401.
Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Request each listed path on the live site and confirm it returns 404 or 403.