Your admin page is on the internet
Why sign-in pages, admin panels and data connections that anyone can reach deserve extra care.
Most sites have parts only you should use, like an admin panel, a dashboard or the connection your app uses to read its database. If they live on the same public address as your site, anyone can find them.
Being reachable isn't a problem by itself. The trouble starts when something reachable also answers without asking who you are.
What a scan looks for
- A data connection that returns records without signing in, like a database table or a list of users that should be private.
- An API that answers some requests with sign-in and the same requests without it.
- Tools meant for developers, like a public list of every API action or a query explorer, left on in the live site.
- Sign-in cookies that are visible to scripts on the page.
These come up often with apps built quickly on services like Supabase or Firebase, where access rules start open while you build and are easy to forget.
What to do
Check the access rules of every data source your app uses, so each one only answers people who are signed in and allowed. Turn developer tools off in the live site. When you can, put the admin panel behind an extra sign-in or on an address only your team uses.
A scan tells you what answered, with the request it sent, so your developer can repeat it.
Was this helpful?