Exposed admin and debug tools

Admin consoles, debug pages and API explorers belong behind a login or on a private network.

What it is

Examples are phpMyAdmin, Adminer, Hasura and PocketBase consoles, Spring Boot actuator pages, Prometheus metrics, Laravel Telescope and Horizon, the Rails info page, GraphQL IDEs, Storybook and Swagger UI.

Why it matters

A reachable login puts the admin in front of every attacker who tries passwords. A debug page shows settings, routes, memory or requests of the running app. Public API documentation lists every endpoint, including the internal ones.

How Tenty checks it

Tenty asks for the known paths of these tools and checks that the answer carries the signature of the tool. This runs for verified owners only.

How to fix it

Take the tool off the public internet, or put it behind your own sign in or a VPN. Turn off debug endpoints in production settings. Rotate anything the page showed.

How to reproduce

curl -sSI 'https://YOUR-APP/PATH'

Use the path from the finding.