Progress

0 / 13 hidden things found this session. Everything below is reachable only by reading /static/app.js (and what it points to) — no link in the visible app maps to any of it.

⬜ Hidden endpoint: internal user list (/api/internal/users)

⬜ Hidden endpoint: debug config dump (/api/debug/config)

⬜ Hardcoded API key found in app.js

⬜ Hidden endpoint: admin metrics unlocked with the API key (/api/admin/metrics)

⬜ Hidden endpoint: v2 export (/api/v2/export)

⬜ Hidden endpoint: legacy backup (/api/legacy/backup)

⬜ Hidden parameter: ?debug=1 verbose output

⬜ Hidden parameter: ?role=admin behaviour change

⬜ Hidden parameter: ?format=raw raw export

⬜ Hidden parameter: ?impersonate=<id> (IDOR-flavoured)

⬜ Hidden parameter: ?feature=<flag> feature-flag unlock

⬜ Secondary JS chunk fetched (/static/legacy.chunk.js)

⬜ Source map fetched (/static/app.js.map)