First-party AI-like API path strings were found in client content
ShipReady found supported quoted relative path strings for first-party AI-like API routes in captured page content or fetched JavaScript.
Why it matters
An inventory of client-referenced AI-like paths can help an owner review which routes are intentionally exposed through client code.
How ShipReady detects it
What it inspects
ShipReady searches captured page HTML and fetched JavaScript for quoted relative paths with an /api or /v1 segment and a supported AI-related path segment.
What triggers a finding
The rule triggers when one or more supported first-party relative path strings are found. Matching is case-insensitively deduplicated, and the evidence lists at most 15 paths.
What the evidence shows
The reported client content referenced the listed path strings matching ShipReady's bounded first-party AI-like path pattern.
Limits of this check
ShipReady does not request or verify these paths. It does not prove that a route exists, is reachable, accepts anonymous requests, is vulnerable, bills usage, or lacks rate limits. Absolute provider URLs and ordinary page routes outside the supported pattern are excluded.
How to fix it
Review each referenced path
Identify the intended route behind each listed path and confirm that it belongs in the product's client-facing API surface.
Verify server-side controls separately
Test the deployed routes using the application's intended authentication, authorization, input-validation, and operational controls.
How to verify the change
Compare client references with deployed routes
Review the listed path strings against deployed route ownership and server-side behavior using controlled application tests.
Expected: Each client-referenced AI-like path has an intentional and reviewed server-side implementation or is removed from delivered client content.