Your API documentation is publicly reachable
A documentation path serves API documentation to anyone who asks, with no authentication.
Why it matters
A documentation path serves API documentation to anyone who asks, with no authentication. What this exposes is not one endpoint but the whole map: every route, every parameter and its type, the shape of every request and response, and usually the authentication scheme. That is the reconnaissance an attacker would otherwise have to do by hand, published as a machine-readable file. Nothing on the pages we crawled links to it, which is the signature of a framework default rather than a decision. FastAPI serves `/docs`, `/redoc` and `/openapi.json` unless you switch them off; springdoc serves `/v3/api-docs`; NestJS scaffolds mount `/api/docs`. If you publish these docs deliberately, this is expected — check that the schema describes only endpoints you meant to make public, and move on.
How ShipReady detects it
Framework-default API documentation left reachable in production. SITE-scoped for two reasons. The probes are fixed ORIGIN paths, so they must be sent once per scan rather than once per page; and the intentional-vs- accidental discriminator reads the links of every crawled page, which only this scope can see.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
Your API documentation is served publicly with no authentication. Decide first whether you meant to publish it — if you did, skip to the last paragraph; if you did not, it is a framework default and you turn it off in one line. TURN IT OFF WHERE IT IS A DEFAULT. • FastAPI: `FastAPI(docs_url=None, redoc_url=None, openapi_url=None)`. All three — disabling only `/docs` leaves `/openapi.json`, which is the whole schema. • springdoc (Spring Boot): `springdoc.api-docs.enabled=false` and `springdoc.swagger-ui.enabled=false`. • NestJS: guard the `SwaggerModule.setup(...)` call behind an environment check so it only runs outside production. • ASP.NET / Swashbuckle: keep `app.UseSwagger()` and `app.UseSwaggerUI()` inside `if (app.Environment.IsDevelopment())`. GATE IT INSTEAD OF DELETING IT if your team uses it. Put the docs routes behind the same authentication as the rest of your admin surface, or behind your VPN or an IP allow-list. Do not rely on the URL being unguessable — these paths are framework defaults, so they are the first thing anyone checks. THEN CHECK WHAT THE SCHEMA GAVE AWAY. It lists every route, so treat it as a map someone may already have: confirm each endpoint enforces its own authentication and authorisation server-side rather than relying on being undocumented, and pay particular attention to admin, internal and debug routes that were never meant to be reachable. An exposed schema is not itself a breach, but it removes the guesswork from finding one. IF YOU PUBLISH DELIBERATELY, this is expected and you can ignore the finding — but make the publication explicit: keep a separate, curated schema for the public docs rather than serving the one your framework generates from every route, so an internal endpoint added next month does not quietly appear in your public documentation.
Frequently asked questions
- What does "Your API documentation is publicly reachable" mean?
- A documentation path serves API documentation to anyone who asks, with no authentication.
- How serious is it?
- ShipReady rates this medium. Fix soon. Meaningfully weakens a defence or degrades how the site works.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
Run this check on your site
ShipReady checks this and 193 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.