SH017: API documentation exposed¶

Severity: low · Category: security · Applies to: aspnet, fastapi

Why it matters¶

Interactive API documentation lists every endpoint and parameter, which helps attackers map the application. It is meant for development.

Disable it in production: FastAPI(docs_url=None, redoc_url=None, openapi_url=None), or call UseSwagger only inside an IsDevelopment() check.

Skip it everywhere in devshield.yml:

ignore:
  - SH017

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH017