Expected Findings
- Redis 7 is bound to `0.0.0.0:6379` with `requirepass` empty.
- Session keys with login state are listable via `KEYS session:*`.
- `MONITOR` output is captured into a public log endpoint.
A Redis instance is presented as publicly reachable on 6379 with no auth, leaking session keys, queue contents, and live commands.
bind 0.0.0.0 requirepass "" protected-mode no