trust.liveApiSecurity
trust.heading
liveapisec.com/trust/polls-api
trust.disclaimerTitle
trust.disclaimerText
trust.disclaimerText
LiveAPISec scanned this system with automated security tests during the latest scan (2026-11-09 11:15:00.160000). No open high/critical vulnerabilities.
- trust.lastScan
- 2026-11-09 11:15 UTC
trust.scopeTitle
✓BOLA/IDOR
✓Broken authentication
✓Mass assignment
✓Injection (SQL/NoSQL)
✓Rate limiting
✓CORS misconfiguration
✓Security headers
✓Sensitive parameters
trust.deepTitle
✓Shadow APIUndocumented endpoints reachable beside the specification.
✓JWT weaknessesWeak signing, none-algorithm or guessable token secrets.
✓HTTP method tamperingBypassing controls by switching GET/POST/PUT/DELETE.
✓Technology fingerprintingRevealed stack versions helping targeted attacks.
✓Mass assignment (nested)Privilege fields hidden in nested objects or arrays.
✓Information disclosureStack traces, internal paths or versions in responses.
✓Rate limiting (per-endpoint)Sensitive endpoints missing their own stricter limits.
✓Old API versionsDeprecated versions still live with weaker controls.
✓GraphQL surfaceIntrospection enabled and unprotected GraphQL resolvers.
✓OAuth flowRedirect, state and code handling in login flows.
✓CORS chainsChained origins or null-origin trust issues.
✓SSRF canaryServer-side requests triggered via user-supplied URLs.
✓Cookie flagsSession cookies missing HttpOnly, Secure or SameSite.
✓User enumerationLogin or signup revealing which accounts exist.
✓Timing oracleResponse-time differences leaking secrets or users.
✓Path traversalFile access outside the intended directory.
✓Open redirectRedirects abusable for phishing via trusted domain.
✓HTTP TRACE / TRACKDangerous methods enabling header reflection attacks.
✓Backup filesExposed backups (.bak, .old, ~) with source or data.
✓Default credentialsVendor or demo logins left active.
✓Encoding tricksFilter bypass via URL, unicode or double encoding.
✓OAuth code replayReused authorization codes granting extra tokens.
✓OTP replayOne-time codes accepted more than once.
✓Session cookie forgeryUnsigned client-side session data editable by the user.
✓Insecure deserializationUntrusted objects decoded without integrity checks.
✓Subdomain takeover chainDangling records allowing hostile subdomain control.
✓Blind SQL injectionDatabase probing via boolean or time-based signals.
✓OS command markersShell metacharacters reaching system commands.
✓Method overrideX-HTTP-Method-Override bypassing verb controls.
✓Nested mass assignmentDeep-object binding without an allowlist.
✓Actuator / debug valuesExposed ops endpoints leaking config or metrics.
✓PII in errorsPersonal data echoed back in error messages.
✓Sourcemap secretsSource maps exposing original code and keys.
✓Known CVEsFingerprinted components matched against CVE feeds.
✓Bundle composition (SCA)Vulnerable libraries shipped in client bundles.
✓Secret patternsAPI keys or tokens hardcoded in responses or files.
✓Batch IDORBulk endpoints authorizing once instead of per item.
✓SMS pumping guardUnthrottled SMS endpoints enabling toll fraud.
✓security.txtMissing vulnerability disclosure contact point.
✓Email authenticationSPF/DKIM/DMARC gaps enabling sender spoofing.
✓Certificate transparencyForgotten subdomains found in public certificates.
✓Subdomain enumerationExtra subdomains widening the attack surface.
✓WAF fingerprintProtection behaviour mapped for evasion testing.
✓Sunset / deprecation headersRetired endpoints served without a sunset policy.
✓OpenAPI examplesReal credentials or PII left in spec examples.
✓JWT algorithm confusionRS256↔HS256 mix-ups accepting forged tokens.
✓Session fixationSession id not regenerated after login.
✓Refresh-token reuseRotated refresh tokens accepted twice without alarm.
✓PKCE downgradeOAuth code flow accepted without code challenge.
✓Logout replayTokens still valid after logout.
✓Host header injectionPassword-reset or cache keys poisoned via Host header.
✓Magic header bypassInternal headers (e.g. X-Forwarded-For) trusted blindly.
✓Redirect evasionsAllowlist bypass with crafted redirect targets.
✓Mass assignment via queryPrivilege fields smuggled through URL parameters.
✓Error oracleVerbose errors distinguishing valid from invalid data.
✓Sort / filter injectionQuery operators reaching the database unsanitized.
✓Token in URLSession tokens leaked via addresses, logs or referers.
✓MFA bypassSecond factor skippable via direct endpoint calls.
✓OAuth scopeOver-broad or unenforced permission scopes.
✓OTP brute-forceShort codes guessable without throttling.
✓MFA push fatiguePush approvals spammable until the user accepts.
✓Step-up authenticationSensitive actions missing fresh re-authentication.
✓Server-side template injectionTemplate syntax executed on the server.
✓SSTI enginesTemplate injection probed across engine dialects.
✓XXEXML external entities reading server files.
✓CRLF injectionResponse splitting via injected line breaks.
✓Prototype pollutionJSON keys polluting shared JavaScript objects.
✓HTTP parameter pollutionDuplicate parameters changing server-side logic.
✓SQL dialectsInjection probed across database-specific syntax.
✓Second-order injectionStored payloads executed in later requests.
✓Type juggling in authLoose comparisons letting crafted types pass login.
✓Batch atomicityPartial batch execution leaving inconsistent state.
✓Replay protectionCaptured requests replayable without freshness checks.
✓Cart tamperingClient-side prices or quantities trusted by the server.
✓Coupon guessingPredictable discount codes enumerable without limits.
✓Decimal edge casesRounding gaps in money calculations.
✓Race conditionsParallel requests bypassing single-use or balance checks.
✓Negative quantitiesNegative amounts crediting the attacker balance.
✓Currency swapCurrency switched after price was fixed.
✓Shipping tamperingDelivery fees or addresses altered post-checkout.
✓CSV formula injectionExported cells executing formulas in spreadsheets.
✓Integer overflowExtreme numbers wrapping limits or balances.
✓Schema driftLive responses diverging from the documented contract.
✓Version downgradeClients forced onto older, weaker API versions.
✓State-machine skipMulti-step flows (checkout, verify) jumped out of order.
✓UUID / IDORUnpredictable ids still served across accounts.
✓Request smuggling shapeAmbiguous requests interpreted differently by proxies.
✓Takeover markersFingerprints of hijackable third-party services.
✓TLS postureWeak protocols or ciphers on the endpoint.
✓Path confusionTrailing slashes or dots routing past access checks.
✓Double encodingTwice-encoded paths slipping through filters.
✓WAF bypassPayload variants evading firewall rules.
✓WebSocket handshakeSocket upgrade missing origin or auth checks.
✓gRPC surfaceExposed RPC methods beyond the REST contract.
✓GraphQL aliasesAliased batched queries evading limits.
✓Cache poisoningTainted responses served to other users.
✓Private network accessPublic pages reaching intranet resources via browser.
✓Cookie domain scopeOver-wide cookie domains shared with subdomains.
✓Upload polyglotDisguised executables passing file-type checks.
✓Stored XSSPersisted scripts executed in other users' browsers.
✓Content-type confusionMismatched types triggering unsafe parsing.
✓Malware-scan signalTest malware signature passing upload scanning.
✓PII in pathsPersonal identifiers embedded in URLs or logs.
✓Open proxyFetch or proxy endpoints relaying arbitrary targets.
✓SSRF featuresImport, webhook or avatar fields fetching internal hosts.
✓Callback channelWebhooks callable by attackers with forged events.
✓Presigned URL lifetimeOver-long signed URLs widening exposure window.
✓Unbounded exportFull-table dumps without pagination or role gates.
✓Living-off-the-land endpointsBenign utilities repurposed for data extraction.
✓Dead-drop endpointsOrphaned debug endpoints usable for data staging.
✓Webhook deputyConfused-deputy calls via trusted webhook integrations.
✓JWT kid / jkuKey-id or key-URL headers pointing at attacker keys.
✓Cache deceptionAuthenticated pages cached and served to strangers.
✓Cache-key confusionIgnored parameters splitting or merging cache entries.
✓CORS + cache poisonPoisoned CORS responses distributed via cache.
✓Throttle signalsMissing 429/Retry-After signalling on hot endpoints.
✓Redirect × CORS comboRedirect chains combined with lax origin trust.
✓Device flowDevice-code login abusable via polling or phishing.
✓OAuth stateMissing state enabling login-CSRF attacks.
✓x5c trustAttacker certificates smuggled via token headers.
✓JWE confusionEncrypted tokens downgraded to plain signed ones.
✓DPoP downgradeProof-of-possession dropped without rejection.
✓Remember-me cookieLong-lived login cookies forgeable or never revoked.
✓Presigned URL reuseSingle-use links working repeatedly.
✓Deep JSON fuzzDeeply nested payloads stressing parsers.
✓Schema fuzzingType-swapped fields revealing validation gaps.
✓GraphQL suggestionsError hints disclosing hidden schema fields.
✓Persisted queriesStored GraphQL operations callable without auth.
✓WAF evasion setExtended firewall-bypass payload collection.
✓Framework mass-assignFramework-specific auto-binding of sensitive fields.
✓Cursor tamperingPagination cursors edited to page into other users' data.
✓Mail relayContact or invite forms sending arbitrary mail.
✓Referer leakSecrets carried to third parties via Referer header.
✓Invite enumerationInvitation tokens guessable or unbounded.
✓Open storage bucketPublic cloud buckets with private dumps.
✓Password-spray guardOne password tried across many accounts undetected.
✓Version negotiationContent negotiation serving unintended variants.
✓Cookie tossingSubdomain-set cookies overriding session state.
✓Attack pathsChained findings composed into exploit paths.
✓Cross-tenant replayTokens or ids replayed across organizations.
✓Token claimsMissing audience or expiry enabling cross-API replay.