Public API Exposure
NullFault checks whether API routes discovered from the app expose sensitive data or are reachable without the authentication expected in production.
What NullFault Checks
- Whether routes discovered from the public app surface can be reached without authentication.
- Whether the response suggests sensitive data, private operational details, or secret-like values.
- Whether normal protected responses (401, 403, 404, app fallbacks) are treated as protected rather than flagged as exposed.
Why It Matters
- Public APIs are normal. Public APIs returning private data are not.
- Route discovery from frontend assets often reveals endpoints teams forgot to test directly before launch.
- A single unauthenticated response can expose users, internal state, or integration details.
Common Causes
- Demo or internal endpoints left enabled in production.
- Authorization checked in the UI but not on the API.
- Assuming an endpoint is private because it is not linked in the UI.
Check it yourself
Open a discovered API URL in a private browser window with no login. If it returns real user or internal data, it is publicly reachable.
Mitigation
- Require authentication and authorization for user-specific or operational data.
- Return minimal public data from unauthenticated endpoints.
- Make unauthorized responses explicit and consistent.
- Review route handlers built for demos, preview environments, or internal testing before launch.
Reality check
NullFault does not prove business-logic impact from a single response. It reports what was reachable and why that response deserves review.