Access control
Data is available without signing in at all
Missing authentication on data endpoint
What this means
Some addresses in your app return data to anyone who opens them — no sign-in required. These are usually forgotten internal or temporary pages.
Why it matters
Automated scanners and search engine crawlers find such addresses. The data ends up in search results and web archives, where you can no longer remove it.
How to fix it
- Deny by default: without a session your app should not return data.
- Review temporary and internal addresses left over from development.
Prompt for your AI agent
Require authentication on every address that returns data. Without a valid session the app should respond with 401.
Verify the fix: open the address with no session — expect a refusal
Is your app doing this?
Find out in about a minute — the first scan is free.