Scan rule · RSC-SEC-027
Admin area reachable anonymously
SecuritySeverity: HighCWE-306OWASP A01-2021
Requests discovered admin paths anonymously and reports content instead of a redirect to sign-in.
Scan tier
External scan (anonymous)
How to fix it
Move the server-side access check in front of rendering (middleware or layout guard).