domains / families / security / hunt-metrics-exposure

hunt-metrics-exposure

separate

Hunt public /metrics, /health, and actuator endpoints leaking AI usage, DB pools, and operational intelligence.

When to use

• The target uses modern observability tooling (Go, .NET, Java, Node.js). These frameworks often expose `/metrics`, `/health`, and `/status` endpoints that are forgotten behind auth. Unlike application data leaks, metrics leaks reveal the EN…

When not to use

• Prometheus /metrics without secrets
• Spring Boot Actuator /actuator/metrics without sensitive data
• JMX without auth if read-only
• Health endpoint without sensitive data

Skill page

Source