Security guides
API Exposure

Public API Exposure

NullFault checks whether API routes discovered from the app expose sensitive data or are reachable without the authentication expected in production.

What NullFault Checks

  • Whether routes discovered from the public app surface can be reached without authentication.
  • Whether the response suggests sensitive data, private operational details, or secret-like values.
  • Whether normal protected responses (401, 403, 404, app fallbacks) are treated as protected rather than flagged as exposed.

Why It Matters

  • Public APIs are normal. Public APIs returning private data are not.
  • Route discovery from frontend assets often reveals endpoints teams forgot to test directly before launch.
  • A single unauthenticated response can expose users, internal state, or integration details.

Common Causes

  • Demo or internal endpoints left enabled in production.
  • Authorization checked in the UI but not on the API.
  • Assuming an endpoint is private because it is not linked in the UI.

Check it yourself

Open a discovered API URL in a private browser window with no login. If it returns real user or internal data, it is publicly reachable.

Mitigation

  • Require authentication and authorization for user-specific or operational data.
  • Return minimal public data from unauthenticated endpoints.
  • Make unauthorized responses explicit and consistent.
  • Review route handlers built for demos, preview environments, or internal testing before launch.

Reality check

NullFault does not prove business-logic impact from a single response. It reports what was reachable and why that response deserves review.

Related guides