Glossary
Exposed path
An address that answers when it should not.
What it means
An exposed path is a URL on your app that returns something useful to a stranger. An admin page with no check in front of it. An environment file. A database dump left in the public folder. A build artefact. A debug route someone added on a Tuesday.
None of it is linked from your interface, which is why it survives. It does not need to be linked. These addresses are guessed by lists, thousands at a time, by tools that cost nothing to run.
The Moltbook exposure involved an open admin route alongside missing access rules. A check requests a set of common paths and reports the ones that answer, with the status code as evidence. The fix is either delete or put a real check in front.
Incidents where it mattered
No incident in the library maps to this one yet.
ShipReady is not a penetration test or a security certification. No automated check can prove an application is secure.
Last updated September 20, 2026