Public information files

Debug routes, admin pages and leftover files survive because nothing links to them. Nothing needs to. Address lists are guessed thousands at a time by tools that cost nothing to run, and an admin route with no check in front of it was one of the causes of the Moltbook exposure.

These files tell crawlers and researchers how to treat the site.

GET https://example.com/admin returned 200

Every finding on a result carries a line like this one: the request that was made and the answer that came back. You can run the same request yourself and get the same answer, which is the point.

Nothing to do. A security.txt file gives researchers a way to reach you.

A result gives you this prompt written for your builder, in its own dialect, and a batch prompt that carries every fix at once.

• Observed

  Moltbook records exposure

  An app exposed 4.75 million records, including 1.5 million API tokens and 35,000 email addresses.

  2026-01

  Read the incident

• exposed path
• observed
• evidence