The five suites

Unguarded access

Unguarded access answers a single question: what does this call return when nobody is signed in?

1. 01

   Use the catalog as the request list

   Each captured call is sent again with the Anonymous identity. That identity sends no cookie and no authorization header.

2. 02

   Compare status and body

   A response that still returns data with no session is the finding. A login page that returns 401, or an empty object, is not treated as a leak.

3. 03

   Read the finding

   The row names the route, Anonymous as the identity, the HTTP status, and the redacted evidence. The raw body is not written down.

GET /api/users
Identity   Anonymous
Status     200
Severity   HIGH
Evidence   [{ "email": "[REDACTED_EMAIL]", "phone": "[REDACTED_PHONE]" }]

See the redacted example