Agent Wranglers

Data and secrets Required

Close debug and admin doors

Remove debug, test and status tools from production, or put them behind a login and a private network.

By Erik Bergstedt, Agent Wranglers. Updated .

How to do it

Keep a list of every route the app serves, and compare it with the routes you meant to publish. Turn off framework consoles and API explorers in production. Put admin pages on a separate address that only staff can reach.

Example

/admin  /debug  /console  /actuator  /phpinfo.php  /graphql (with introspection)  /swagger  /server-status

How to check

The agent requests common debug and admin paths. Each one answers 404 or asks for a login.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers security testing playbook: https://agentwranglers.se/playbook/adversarial-testing/data-and-secrets/close-debug-doors.