Home·Guides·What an unguarded route looks like
What an unguarded route looks like
Routelint·
An unguarded route is a handler that still returns someone’s data after the session cookie and the bearer token are removed.
The catalog records the call the interface made, including the URL and the JSON body. The unguarded-access suite sends that call again as anonymous. A 401 or an empty body is a pass. A 200 that still contains emails, invoices, or profile fields is the finding.
On the demo shop, the page loads and the browser calls GET /api/users. The anonymous replay receives the user list. The finding stores the route, the anonymous identity, and the redacted response.