doors/no-public-api-docs
Swagger, OpenAPI and runtime config files are not public in production.
Install
firedrill hub add doors/no-public-api-docs
Reads
config.domains, web.api_docs
Fix when it fails
Put these paths behind authentication, or remove them from production builds.
Test cases
| Case | Expected |
|---|---|
| clean | PASS |
| public | FAIL |
| nothing | N/A |
Drill file
firedrill: v0
id: doors/no-public-api-docs
safeguard: "Swagger, OpenAPI and runtime config files are not public in production."
severity: high
for_each: config.domains
fetch:
docs: { fact: web.api_docs, args: { domain: target.domain } }
pass_when:
- docs.found.size() == 0
fix: "Put these paths behind authentication, or remove them from production builds."