Unlinked API documentation was publicly served at a supported default path
ShipReady found recognised API documentation at a bounded default path that no crawled page linked to.
Why it matters
Unintended public API documentation can reveal interface detail, so its visibility should be a deliberate product decision.
How ShipReady detects it
What it inspects
ShipReady performs GET-only probes on a small fixed list of framework-default API-documentation paths and checks crawled pages for links to each path.
What triggers a finding
A finding requires HTTP 200 with a recognised OpenAPI, Swagger UI, ReDoc, or similar supported documentation signature at an unlinked path.
What the evidence shows
A reported default path served recognised API documentation and was not linked from the pages ShipReady crawled.
Limits of this check
ShipReady does not crawl every page, verify authentication beyond the unredirected response, call documented endpoints, inspect every schema field, or prove that the documentation was unintentionally public.
How to fix it
Confirm whether the documentation path is intended to be public
Review the reported default path, the documentation generator, and deployment configuration. A deliberately published API reference may remain public, while an unintended unlinked copy should be removed or restricted.
Publish only the intended reference
Remove the unintended generated artifact from the public build, or apply the access policy appropriate for the API reference. Review the documented endpoints and examples separately from this path finding.
How to verify the change
Recheck the reported documentation path
After deployment, request the same reported path and confirm it either has the intended publication status or no longer returns ShipReady’s API-documentation signature.
Expected: The supported default path exposes only the API documentation the team intentionally publishes.