Is public OpenAPI a vulnerability?

It is an information map. For a public API you already document, curated docs are fine. An unauthenticated Try-it-out UI against production is the miss.

Does RoastMyOpsec fetch Swagger UI?

Not as a scored path. GraphQL introspection on /graphql may be probed in app mode — read-only, no mutations.

Is GraphiQL the same as Swagger?

Same class: an interactive schema browser. Keep it off production.

Vulnerabilities

Swagger UI vs GraphQL Introspection on Production APIs

January 21, 2026

Swagger UI vs GraphQL introspection on production APIs is two ways to publish the schema. Swagger UI /swagger, /docs, and /openapi.json are interactive catalogs. GraphQL introspection (__schema) is a query that dumps types. Neither is a credential, both shrink reconnaissance and sometimes show unreleased fields. Keep docs on a private host. Disable introspection in production. RoastMyOpsec app mode may send one bounded unauthenticated GraphQL introspection POST to /graphql. It does not currently score Swagger UI or openapi.json, does not click 'Try it out,' and does not send mutation payloads.

The practical difference

OpenAPI files are documents. GraphQL introspection is a live query. Authentication on the UI is not enough if openapi.json is still a public GET. robots.txt Disallow: /swagger advertises the path.

Verbose API errors and framework debug are cousins: they donate internals without a full schema browser. See those guides too.

How to choose what to publish

Public product APIs: a curated docs site, not a raw Try-it-out UI against production. Partner APIs: auth on both the UI and the spec URL. Internal: VPN. GraphQL: introspection off in production; use a build-time schema for your own clients.

Surface	Typical leak	First response	Takeaway
/swagger / /docs	Interactive schema + try-it	Remove from public origin	Not a scored roast path today
/openapi.json	Machine-readable map	Auth or private host	Same class as the UI
GraphQL __schema	Live type graph	Disable in production	Roast may probe /graphql
DEBUG / APP_DEBUG	Stack on every 500	Turn off	See framework debug

What the roast can prove

A GraphQL introspection hit can surface in app mode. A 200 on /swagger is not scored today — still remove it. Pair with CORS wildcard if the docs origin can call the API with cookies.

Common mistakes

The first mistake is Swagger UI on api.example.com because 'devs need it.'

The second mistake is auth on /swagger and none on /v3/api-docs.

The third mistake is disabling introspection and leaving GraphiQL at /graphiql.

Free audit the URL you own

RoastMyOpsec is a defensive public-surface roast: headers, cookies, sensitive paths, and more — no exploit payloads. Start with the free audit, then open the vault if the blurred findings look expensive.

Free audit now

FAQ

Is public OpenAPI a vulnerability?: It is an information map. For a public API you already document, curated docs are fine. An unauthenticated Try-it-out UI against production is the miss.
Does RoastMyOpsec fetch Swagger UI?: Not as a scored path. GraphQL introspection on /graphql may be probed in app mode — read-only, no mutations.
Is GraphiQL the same as Swagger?: Same class: an interactive schema browser. Keep it off production.

Sources

Related guides

Vulnerabilities
GraphQL Introspection vs Production APIs
Vulnerabilities
Verbose API Errors vs Generic Client Messages
Vulnerabilities
robots.txt Disallow vs Access Control for Hidden Paths