Expected Findings
- Deprecated API versions remain accessible without auth.
- Backup dump can be downloaded directly.
- Internal reporting endpoints are linked into the browser bootstrap.
Old Internal System
Enterprise Legacy
A legacy portal that still boots from deprecated endpoints, exposes a downloadable SQL backup, and keeps internal reports one link away.
Legacy bootstrap
Primary Flows
- Current user API Expected public-ish endpoint
- Forgotten debug API Deprecated internal route
- Backup dump Direct database export
- Internal reports Sensitive operational notes
Signals
Bootstrap
fetch("/v0/debug/users").then(renderUsers)