An exposed API key in a frontend bundle is a secret credential (a Stripe secret key, a Supabase service-role key, an OpenAI key, a cloud provider key) that got compiled into the JavaScript a browser downloads, instead of staying server-side. Anyone can open your site's network tab, view the bundled .js files, and read the key in plain text. AI app builders make this common because generated code often calls third-party APIs directly from client components using an environment variable that was never meant to be public.

Security headers are HTTP response headers that tell the browser how to treat your page defensively: which scripts are allowed to run, whether the page can be loaded inside a frame, whether HTTPS is mandatory. When they're missing, the browser falls back to permissive defaults, which opens the door to attacks like cross-site scripting, clickjacking, and protocol downgrade that the header would otherwise have blocked outright.

A dangerous CORS misconfiguration is when a server responds with Access-Control-Allow-Origin set to "*" or reflects back whatever Origin header the requester sent, while also setting Access-Control-Allow-Credentials: true. That combination lets any website make an authenticated, cookie-bearing request to your API from a visitor's browser and read the response, effectively letting any third-party site act as a logged-in user against your backend.

An exposed source map is a .map file, publicly reachable next to a production JavaScript bundle, that maps the minified code back to its original, unminified source, including original file names, function and variable names, and code comments. If a production deploy ships .map files publicly, anyone can reconstruct something very close to your original source code, not just the compiled output.

If a deployed app's .env file or .git directory is reachable at a public URL, anyone can download it directly: no exploit required, just a GET request. A public .env file typically contains every secret the app uses in one place (database URLs, API keys, signing secrets), and a public .git/config or .git directory can expose your full commit history, including secrets that were committed and later "removed" but still exist in prior commits.

SPF and DMARC are DNS TXT records that tell mailbox providers which servers are allowed to send email as your domain, and what to do with messages that fail that check. Without them, nothing stops anyone from sending an email that appears to come from your domain: no server compromise required, just a mail server willing to set an arbitrary "From" address, which is how most business-email-compromise and phishing-as-your-brand attacks work.

A subdomain takeover happens when a DNS record, typically a CNAME, still points a subdomain (like app.yourcompany.com) at a third-party service (GitHub Pages, Heroku, an S3 bucket, Netlify, and similar), but the corresponding resource on that service was deleted or never claimed. Anyone can then register that same resource on the third-party service and have it start serving content on your subdomain, under your domain name, with your DNS still pointing at it.

HttpOnly, Secure, and SameSite are cookie flags that restrict how a browser is allowed to handle a cookie. A session cookie missing HttpOnly can be read by any JavaScript running on the page, including injected malicious scripts, and stolen outright. Missing Secure means the cookie can be sent over plain, unencrypted HTTP. Missing SameSite makes the cookie easier to leverage in cross-site request forgery, since it will be sent along with requests originating from other sites.

GraphQL introspection is a built-in feature that lets anyone query your API for its own schema (every type, field, query, mutation, and argument your backend supports) without needing any documentation or credentials. It's essential during development for tools like GraphiQL and Apollo Studio, but if it's still reachable on your production endpoint, anyone can send one request and get a complete, machine-readable map of your entire API surface, including fields and mutations you never intended to advertise.

Exposed API documentation means a route like /swagger.json, /openapi.json, /api-docs, or a GraphQL Playground/GraphiQL UI is publicly reachable on your live domain, handing anyone who finds it a complete, structured reference for every endpoint your API exposes: paths, parameters, request and response shapes, and often authentication requirements. These routes exist specifically to make an API easy to explore, which is exactly the problem when the audience finding them isn't your own developers.

Next.js's Pages Router serves the exact data a page needs to render (the return value of getStaticProps or getServerSideProps) as JSON at a predictable URL: /_next/data/<buildId>/<route>.json. This is by design and normally harmless; it's how client-side navigation avoids a full page reload. It becomes a real finding when that JSON includes fields a page never actually displays, or when a route meant to require authentication serves its data JSON to anonymous requests exactly like a public one would.