Security policy relies on robots.txt to hide sensitive/admin routes (security misconfiguration)

Run

pentest-2026-06-12-372608e0

Target

mbarbine/platphormnews-www-prod

Target URL

https://platphormnews.com

Run status

completed · api-multi-model

Framework

owasp-top-10

Priority score

0.1375

Reachability

model_assessed_from_passive_recon

Chain depth

2

PoC available

no

Asset

not recorded

Discovered

Jun 12, 2026, 05:08 AM

Description

The site exposes multiple admin/protected URL patterns in robots.txt (e.g., Disallow: /admin, /api/admin, /api/private, /api/protected, /api/*/admin, /api/*/private, /api/*/protected) and also disallows URLs containing common secret query parameters (/*?token=, /*?key=, /*?secret=). Using robots.txt as a control mechanism is a misconfiguration risk because robots.txt is not an access-control boundary; it only affects crawling behavior. If backend authorization is not consistently enforced for these routes, this discoverability pattern can directly accelerate attacks by revealing which routes are intended to be sensitive. Evidence: - robots.txt contains explicit Disallow entries for admin/protected API surfaces and patterns. - Multiple public discovery surfaces (/robots.txt, OpenAPI, llms.txt) provide additional routing intelligence.

Validation

The evidence supports that the application’s robots.txt discloses where “admin/protected” routes appear (e.g., /admin, /api/admin, and wildcard patterns). However, this is not an access-control failure by itself: robots.txt is explicitly not an authorization mechanism and, on its own, does not permit access to those endpoints. For this to be a true security misconfiguration finding, the report would need evidence that backend authorization is missing or inconsistent on those routes, or that the site relies on robots.txt to prevent access rather than only to reduce indexing. No such access-control weakness is provided—only that discoverability is improved. Therefore the likelihood/impact is likely overstated for a standalone “security misconfiguration” classification. At most, this is an information-disclosure/recon enhancement issue that can facilitate targeted probing, which aligns better with a lower severity.

Remediation

Do not rely on robots.txt for security. Ensure all admin/protected endpoints enforce server-side authentication/authorization independent of crawler directives. Additionally, remove/avoid leaking route naming patterns in publicly readable documents where feasible, and treat robots.txt as purely advisory for indexing.

Evidence Boundary

This page shows persisted finding evidence, validator rationale, target context, and run linkage. Raw prompts, raw target responses, provider payloads, secrets, cookies, and authorization headers are not rendered publicly. Use the linked run page for class execution evidence, run logs, cost events, and pipeline errors.