Exposed internal tooling

Why it matters

API docs, GraphQL playgrounds and DB admin tools in production give attackers a control panel.

How to fix it

Remove the tool from production or put it behind authentication.

How we test it

Passive — runs in the free check, looks only at what a browser can see.