Stop 30 of 42 · The Blueprints · Hidden endpoints

Doors nobody remembered to lock

The front door of the bank is locked tight and guarded. But the building also has a staff entrance, an old side door from the last renovation, and a test door. They are not on any sign. Mallory just walks around the building trying handles.

The BlueprintsSources checked 25 Oct 2026

Watch it happen

Play it as

Mallory walks around the building trying unmarked doors. The front door is guarded, but the staff, old and test doors open for anyone.

Arrival

Alice and Mallory walk up to the bank. The front door is well guarded: it needs a badge and an appointment. The bank feels safe.

Mallory says: Guarded. Let me look around.

1 / 5

In bank terms and app terms

In the bank	In your app
Unmarked side doors	Routes that aren’t linked in the UI: /admin, /debug, /internal, /test
Old renovation door	Old API versions (/api/v1) kept running after /v2 shipped
Each door has its own lock	Authentication and authorization on every route, not only the ones the UI uses
Walking round trying handles	Crawling and guessing common paths, plus reading your JavaScript bundles for API URLs

Are you exposed?

You might be exposed if…

Some routes are protected only because the UI doesn’t link to them.
Old API versions, demo pages or debug routes are still deployed in production.
Authorization lives in the frontend (hiding buttons) rather than on each server route.

What to do about it

Require auth and role checks on the server for every route, with a default-deny wrapper or middleware, and still check inside sensitive handlers.
Delete retired API versions, test pages and debug routes from production builds.
List all your routes regularly and check each one has an owner and a lock. Treat “nobody knows about it” as no protection.

Track these in your to-do list →

Ask your AI tool to fix it

Paste this into Cursor, Claude, Lovable, Bolt or whatever you build with.

Prompt

List every route and API endpoint in this project (including admin, debug, test and old versioned routes). For each, state whether authentication and role checks are enforced on the server. Add default-deny middleware so new routes require auth, remove unused or debug routes from production, and retire old API versions. Output a table of routes and their protection.

Where this comes from

The facts, figures and fixes on this page were checked against these sources on 25 Oct 2026. They are linked so you can check for yourself.

WSTG: Enumerate Infrastructure and Application Admin InterfacesOWASPHidden admin paths such as /admin are guessed easily and must be found and protected
API9:2023 Improper Inventory ManagementOWASPOld API versions left running and unpatched; keep an inventory and retire old versions
API5:2023 Broken Function Level AuthorizationOWASPAdmin functions are prime targets; enforce deny-by-default on every function
Forced browsingOWASPAttackers guess unlinked URLs that the app doesn't reference but still serves
Authorization Cheat SheetOWASPDeny by default and validate permissions on every request
Access control vulnerabilities and privilege escalationPortSwigger Web Security AcademyHiding a URL is security by obscurity, not access control

Spot a mistake or something out of date? Report a correction · How these guides are made and checked

Go deeper in isitsecure

The free, open-source scanner checks for most of the problems in these guides.