Is your interactive API documentation open to anyone?
This check flags interactive API documentation, such as a Swagger or Redoc page, that anyone can open without signing in. It lists what your API can do for whoever finds it.
What does this check look at?
It looks at whether interactive API documentation is reachable without signing in. Tools meant for developers, like a public list of every API action or a query explorer, left on in the live site, are one of the things Lockpick's guide warns about. No operation is invoked from the page.
Only a Deep scan runs it, after you prove you own the site.
What does a result mean?
| What the report shows | What it means | What to do |
|---|---|---|
| Info finding | A documentation interface answered without sign-in. | Keep it public on purpose, or move it behind sign-in. |
Public documentation is a map for attackers, not proof that any operation is unprotected. A clean result means nothing was found in what the scan read. It does not prove the problem is absent from parts the scan never sees.
How serious is a finding?
This is information only. It claims no weakness, so it carries no verdict, and you decide whether anything should change. Confidence starts high, because a response from your site shows the thing itself. The report lists what to fix by how directly someone could use it, not by the severity label.
Fix it with your AI
Most frameworks mount these pages with one setting you can turn off in production.
My production site serves interactive API documentation (Swagger UI, Redoc or similar) to anyone. Find where my app mounts it, and either turn it off when NODE_ENV is production or protect it with the same sign-in my admin area uses. Do not rely on an unlisted address to hide it. Show me the change.How to check
Say Atlas, our example app at atlas.example, left its Swagger page on in production. A Deep scan notes it as information, with no effect on the grade.
Deep scans come with the Deep plan, and pricing shows what it includes. Pulse or Deep explains what each scan reads, and the full list of checks shows the rest.
Questions people ask
Should public API docs always be removed?
No. If your API is a product others build on, public docs are the point. Remove them when they describe internal routes.
Does hiding the docs make my API safe?
No. Attackers can still find routes in your site code. Every route needs its own sign-in and permission checks.
Run this check on your site
Only a Deep scan runs this check, once you prove you own the site. Deep walks your whole site, the scripts it loads and your API surface.
Run a Deep scanSources
- How we rate findings Lockpick docs, read on October 7, 2026
- Your admin page is online Lockpick docs, read on October 7, 2026