Security Test: Unhandled endpoint¶

Description¶

Default Severity: info

When a system shows an endpoint in its API documentation or introspection but doesn’t build any logic around it, it creates an unexpected weak spot. Attackers might probe this gap and look for unexpected behaviors, and if the system doesn’t properly close the door, it could allow misuse, crashes, or even unauthorized access in certain cases. Developers often overlook these “unused” endpoints thinking nothing happens, but leaving them visible or accessible can lead to unintended security holes in your application.

Configuration¶

Identifier: configuration/unhandled_endpoint

Examples¶

All configuration available:

checks:
  configuration/unhandled_endpoint:
    skip: false # default

Compliance and Standards¶