Exposed internal/monitoring endpoint
An internal endpoint that should never be public is reachable without authentication and is returning real data.
Why it matters
An internal endpoint that should never be public is reachable without authentication and is returning real data. Depending on which one, it exposes environment variables and configuration (Spring Boot Actuator), full server and PHP configuration (phpinfo, server-status), or internal metrics that map your infrastructure. These are development and operations tools — restrict them to internal networks or require authentication, and if it leaked configuration, rotate anything sensitive it revealed.
How ShipReady detects it
Origin-scoped: every path here is a property of the deployment, not of a document, so it is probed once against the seed. All probes run concurrently in one client, and each finding is gated on a content signature.
Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.0.0.
How to fix it
This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.
An internal or monitoring endpoint is reachable without authentication and is returning real data. Depending on which one this is, it exposes your environment variables and configuration (Spring Boot Actuator's /actuator/env), full PHP or server configuration (phpinfo.php, Apache server-status), or internal metrics that map your infrastructure (/metrics). Lock it down: disable the endpoint in production if you don't need it, or require authentication and restrict it to internal networks (Actuator: expose only /health and secure the rest; remove phpinfo.php entirely; disable Apache mod_status or scope it to localhost; put Prometheus /metrics behind auth or a private network). If it leaked any configuration values, rotate them.
Frequently asked questions
- What does "Exposed internal/monitoring endpoint" mean?
- An internal endpoint that should never be public is reachable without authentication and is returning real data.
- How serious is it?
- ShipReady rates this high. Fix before launch. A real weakness that an attacker can act on.
- How do I fix it?
- Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.
- Can I check my own site?
- Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.
Related checks
Run this check on your site
ShipReady checks this and 193 other things across up to ten pages of your site, with an AI-ready fix for each. Free, no signup.