open_endpoints
Read-onlyIdempotent
Identify publicly accessible Django REST Framework endpoints whose serializers expose sensitive fields, helping detect potential data leaks.
Instructions
Endpoints anyone can call, crossed with what their serializer exposes.
serializer_exposure knows CustomerExportSerializer leaks a password reset
token; a Semgrep rule knows a view has AllowAny. Each alone is a judgement
call - maybe the serializer only feeds an admin export, maybe the view
serves a catalogue. Together there is nothing left to judge, and neither
check can make the connection alone.
DRF's own default permission is AllowAny. A project that never configured
DEFAULT_PERMISSION_CLASSES has every view without explicit
permission_classes open, and none of them say so; that is volunteered
first. Views overriding get_permissions() are listed, not judged.
Args:
include_unbounded: also report open endpoints whose serializer uses
fields="__all__" or exclude, even with nothing sensitive on the
model today. The next migration decides what leaks.
Input Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| include_unbounded | No |
Output Schema
TableJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||