Scan rule · RSC-SEC-096
API description (OpenAPI/Swagger) publicly accessible
Checks the usual paths (`/openapi.json`, `/swagger.json`, `/api-docs`, `/docs` …) for an OpenAPI/Swagger description or a Swagger UI / ReDoc page.
Why this matters
An OpenAPI description is the map of your interface: every endpoint, every parameter, every data model, machine-readable. For your own developers that is gold — for someone hunting a spot without an authorisation check, too. They do not have to click through the app; they read the list.
This is not a breach by itself. The interface may be properly secured, and the scan does not claim it is open. But frameworks such as FastAPI, NestJS or Spring serve the docs by default, and in generated apps they stay on because they do not get in the way of the preview.
Check it yourself: `curl -s https://your-domain.com/openapi.json | head -c 300` (and `/swagger.json`, `/api-docs`, `/docs`). If the response starts with `openapi` or `swagger`, or the page loads Swagger UI, the description is public.
Scan tier
How to fix it
Disable the docs in the production build or put them behind sign-in — unless the API is explicitly meant for external developers.