See Datashielder in action
A live-style preview of the target view — vulnerabilities, scan history, and severity in one command-center panel.
Scan History
Security Reports
Findings that require your attention
Plaintext credentials exposed via /debug endpoint
Data ExposureIDOR on /orders/:id allows cross-tenant access
Unauthorized Data ManipulationReflected XSS in search parameter
Data ExposureMisconfigured CORS on analytics subdomain
Data ExposureReport Detail
What a team sees after opening a finding
Plaintext credentials exposed via /debug endpoint
Found on https://api.acme-shop.com/debug/config
What's happening
A publicly reachable debugging endpoint is returning application configuration that should stay server-side. In this sample, it includes credentials and customer-identifying fields, so anyone who discovers the URL could copy information intended only for the service.
Why it matters
Exposed credentials can let an attacker access connected services; exposed email and national ID data can create privacy, fraud, and breach-notification risk. The report connects the technical issue to its business impact so it can be triaged quickly.
Evidence observed
The scanner received a successful response without an authentication challenge. Sensitive values are redacted in the evidence view, while the report preserves enough context for the owner to verify and fix it.
HTTP/1.1 200 OK
content-type: application/json
{ "databaseUrl": "[REDACTED]",
"supportEmail": "[REDACTED]" }How to verify
- 1Open the affected endpoint in a private browser session, with no application login.
- 2Confirm that the response is available publicly and contains configuration or diagnostic data.
- 3After fixing, re-run the scan and verify the endpoint returns 404 or requires appropriate access controls.
Recommended remediation
- ✓Remove the debug route from production builds, or put it behind administrator authentication.
- ✓Rotate any credentials that may have been exposed, even if the endpoint is now closed.
- ✓Review deployment settings to prevent debug configuration from being published again.
Scan Timeline
Historical record of all security scans
| Status | Started | Completed | Reports |
|---|---|---|---|
| In Progress | Apr 17, 2026 09:14 | — | 0 |
| Completed | Apr 10, 2026 02:00 | Apr 10, 2026 02:07 | 3 |
| Completed | Apr 03, 2026 02:00 | Apr 03, 2026 02:05 | 1 |
| Failed | Mar 27, 2026 02:00 | Mar 27, 2026 02:01 | 0 |
| Completed | Mar 20, 2026 02:00 | Mar 20, 2026 02:06 | 2 |
| Completed | Mar 13, 2026 02:00 | Mar 13, 2026 02:04 | 0 |