Your real attack surface is every route you forgot.

Most apps don't get breached through a clever zero-day. They get breached through the one endpoint nobody remembered to protect. A POST /admin/delete-user with auth but no role check. A mutation route shipped before the middleware was wired up. IOnclad walks your codebase, lists every route it can find, and tells you which ones are wide open.

What it actually does

The API Surface Mapper reads your source and discovers routes across the frameworks people actually ship with. For each one it asks the boring questions an attacker asks first: is there auth on it, is the input validated, is it rate limited, can a normal user hit an admin path. It works on these out of the box:

Express / router Next.js API routes Fastify Django views & urls Flask FastAPI Rails resources

Why an open route hurts

A route map isn't busywork. Each gap below is a different way the same endpoint gets turned against you.

1. The admin route with no role check

This is the nastiest one and the easiest to miss. The route has requireAuth, so it looks protected. But "logged in" is not "allowed." If POST /admin/delete-user never checks that the caller is actually an admin, then any signed-up user, a free-tier account, a throwaway signup, can call it. IOnclad flags admin, manage, and internal paths that have authentication but no role or permission gate, and it rates that as Critical.

2. Mutation endpoints with no auth at all

A POST, PUT, PATCH, or DELETE that writes data with no authentication middleware lets anyone change your records without logging in. The scanner looks for the auth patterns each framework uses (requireAuth, passport.authenticate, @login_required, FastAPI Depends(), and so on) and flags the mutation routes that have none.

3. No input validation, no rate limit

Unvalidated request bodies are the root of injection, type confusion, and data corruption. A login or password-reset route with no rate limiting is a free brute-force target. IOnclad checks mutation routes for a recognized validator (Joi, zod, yup, express-validator, ajv, Fastify schemas, class-validator, and more) and checks sensitive routes for a limiter or throttle.

4. CORS that trusts everyone

If your API sets Access-Control-Allow-Credentials: true together with a wildcard or reflected origin, any website on the internet can make authenticated requests as your logged-in users with their cookies attached. That is a cross-site data-theft vector. The scanner catches the credentials-plus-wildcard combination and leaves a correct, specific allowlist alone.

The trap

"It has auth, so it's fine" is the line that ships the breach. Authentication tells you who someone is. Authorization tells you what they're allowed to do. An admin endpoint that checks the first but not the second is open to every account you have.

The shape of a real incident

It usually reads like a small oversight, because it is one:

// Looks locked down. It isn't.
app.post('/admin/delete-user', requireAuth, (req, res) => {
  db.deleteUser(req.body.id);   // any logged-in user can call this
});

// The fix is one more middleware: prove the caller is an admin.
app.post('/admin/delete-user', requireAuth, requireRole('admin'), (req, res) => {
  db.deleteUser(req.body.id);
});

How IOnclad catches it

The API Surface Mapper is one of IOnclad's scanners and runs 100% offline. Your code never leaves your machine. It works file by file, so it reports findings as High where auth could live in another file it can't see, and reserves Critical for the unambiguous gaps:

Discovers routes across seven frameworks (Express, Next.js, Fastify, Django, Flask, FastAPI, Rails) and reports the method, path, file, and line.
Admin / manage / internal paths with no role or permission check are flagged Critical, even when basic auth is present.
Mutation routes with no authentication, with a segment-aware allowlist so genuinely public paths like /login, /webhook, and /health don't cry wolf.
Missing input validation (recognizing a wide set of validation libraries before it flags), missing rate limiting on sensitive routes, and credentials-plus-wildcard CORS.
Catches related traps too: mass assignment (a raw request body spread straight into a create or update), likely IDOR (an object fetched by request ID with no ownership check), file uploads with no size or type limits, and async handlers with no error handling.

It finds known patterns and common misconfigurations. It is not a penetration test or a guarantee, but it surfaces the gaps that get found first.

How to fix it

Gate admin routes on a role, not just a session. Add a requireRole('admin') or permission check after the auth middleware on every admin, manage, and internal path.
Put auth on every mutation. If a route writes data, it needs an authentication check unless it is deliberately public, and "deliberately public" should be a decision, not an accident.
Validate input with a schema on every POST, PUT, and PATCH, and strip unexpected fields so nobody can sneak in isAdmin or role.
Rate limit the sensitive routes (login, signup, reset, token) to blunt brute force and credential stuffing.
Fix CORS: never pair credentials: true with a wildcard or reflected origin. Use a specific allowlist of trusted domains.
Scope every lookup to the current user. Fetch records by ID and owner together so guessing an ID gets nobody anywhere.

Find every secret before someone else does.

Scan your code and full git history in under a minute. Free verdict, no signup, nothing leaves your machine.

Try the Browser Scanner → Download for Windows