Home·Features·Unguarded route example
Unguarded route example
Unguarded access · Demo shop·Routelint·
The same captured call is sent again with no cookie and no bearer token. A 200 that still contains account data is the finding.
- Route
- GET /api/users
- Identity
- Anonymous
- Status
- 200
- Severity
- HIGH
[{ "id": "user-aaa-111", "email": "[REDACTED_EMAIL]", "phone": "[REDACTED_PHONE]", "passwordHash": "[REDACTED_HASH]" }]The demo shop lists every user at /api/users. The stored evidence is the redacted copy.