Publicly Accessible API Documentation via Swagger vulnerability remediation doc#48
Open
ibi420 wants to merge 2 commits intothoth-tech:mainfrom
Open
Publicly Accessible API Documentation via Swagger vulnerability remediation doc#48ibi420 wants to merge 2 commits intothoth-tech:mainfrom
ibi420 wants to merge 2 commits intothoth-tech:mainfrom
Conversation
…iation documentation
❌ Deploy Preview for ontrackdocumentation failed.
|
martindolores
approved these changes
Aug 25, 2025
Contributor
martindolores
left a comment
martindolores
left a comment
There was a problem hiding this comment.
Documentation looks good to me! Not sure if this one is ready as you have put it in draft?
SyedaLamiaTabassum
suggested changes
Sep 15, 2025
| The following components and files were updated as part of this security enhancement: | ||
| - **doubtfire-api:** | ||
| - Updated the Swagger initializer to disable Swagger in production. | ||
| - **Affected file:** `config/initializers/swagger.rb` |
There was a problem hiding this comment.
you can add the changed or the newly added code segment to signify the difference.
Contributor
Author
There was a problem hiding this comment.
It's not good practice to reveal security code in documentation, as it gives attackers knowledge on how to circumvent them.
SyedaLamiaTabassum
approved these changes
Sep 20, 2025
|
Hi @ibi420, I have reviewed the documentation, and everything looks good. No further comments from my side. |
WaelAlahamdi
approved these changes
Sep 20, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This change addresses a vulnerability where Swagger API documentation was publicly accessible in production environments. Swagger has now been disabled in production to prevent unauthorised users from discovering sensitive backend routes and internal API details.
Fixes # (issue)
Type of change
How Has This Been Tested?
/api/swagger_doc.json,/swagger_doc.json) in a production environment./home) and Swagger documentation is no longer exposed.Testing Checklist
Checklist