Debug / actuator / env endpoint
Spring actuator, Django debug, /server-status, /phpinfo, /.git, /graphql introspection, /_next/data, /api/__debug, telescope, horizon, flask-debug, graphql playground.
Tags: debug, info-leak, secrets
Typical severity: P2-P4
What it becomes
Information leak alone is P4. Env with cloud keys, heap dumps, or gateway routes is a foothold.
Where to look
staging hostnamesadmin vhostsforgotten prefixes /api/internalIAP-gated but not actually gated
Chains
- RCE / SSRF — Spring gateway + heapdump, Actuator env + refresh, GraphQL debug to nested SSRF.
- Secret leak — env, config, .git, source maps, firebase config, AWS keys in JS.
- Auth bypass — Debug routes skip the auth middleware the public routes use.
Notes
- Nuclei has a dense debug/exposed-panel set. Run it, then actually open the interesting 200s.
- Source maps next to production bundles are a JS-review gadget, not a finding by themselves.