API9:2023 Improper Inventory Management

Undocumented (shadow) endpoints, deprecated routes still live, OpenAPI spec drift and unprotected admin paths. You cannot secure an endpoint you do not know exists.

What Vulkro detects

Vulkro reconciles discovered endpoints with the project's openapi.yaml, if there is one, and flags drift both ways: in code but missing from the spec, and in the spec but missing from code.

Non-compliant code

# FastAPI: openapi.yaml lists /users, /orders, /products,
# but the admin router is mounted with no spec entry
app.include_router(admin_router, prefix='/internal/admin', tags=['internal'])

Compliant code

# FastAPI: every router mount appears in openapi.yaml
app.include_router(admin_router, prefix='/internal/admin', tags=['internal'])
# openapi.yaml:
#   /internal/admin/*: { ... documented with auth requirements }

How to fix

• Document every mounted router in the spec, with its auth requirements.
• Remove deprecated routes instead of leaving them live.
• Run vulkro scan --gate-vs main in CI to catch new drift.

References

• CWE-1059
• OWASP API9:2023

See also: Confidence model.

---

This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.