Recognised internal or monitoring endpoint output is publicly served
ShipReady found a fixed internal-path response that matched the rule-specific signature for an actuator, metrics, server-status, or phpinfo endpoint.
Why it matters
Public operational output should be reviewed because it can disclose details that were meant for internal use.
How ShipReady detects it
What it inspects
ShipReady probes only /actuator, /actuator/env, /metrics, /server-status, and /phpinfo.php on an eligible origin response.
What triggers a finding
A finding requires HTTP 200 and the endpoint's specific response signature; actuator and metrics HTML shells are excluded.
What the evidence shows
The reported fixed path returned its supported internal or monitoring output signature.
Limits of this check
ShipReady does not authenticate, retrieve additional endpoints, inspect every value in the response, or prove that credentials, infrastructure access, or administrative control are exposed.
How to fix it
Classify the reported operational endpoint
Identify whether the reported actuator, metrics, server-status, or phpinfo endpoint is required externally, required only by infrastructure, or unintended in production.
Restrict or disable unintended operational output
Disable the endpoint when it is unnecessary, or place it behind the network and authentication controls appropriate for its operational consumers. Review the response contents separately from this signature finding.
How to verify the change
Recheck the reported endpoint from an external context
Request the same reported path after deployment and confirm it no longer returns the matched operational-output signature unless public access is intentional.
Expected: The endpoint’s externally served behavior matches the intended operational access policy.