src/main.ts unconditionally calls SwaggerModule.setup('api/docs', app, document) with no NODE_ENV check and no guard. The generated document includes every controller's route, every DTO's shape and validation rules (via @ApiProperty), and enough detail (endpoint list, required fields, enum values) to fully enumerate the API's attack surface — including the money-moving endpoints that #38 already flags as unauthenticated.
Many teams deliberately disable or gate Swagger UI in production specifically to avoid handing an attacker a complete, browsable map of the API (parameter names, validation constraints, exact error-response shapes) with zero effort. There's no code path here that skips SwaggerModule.setup for env === 'production', so whatever gets deployed exposes full interactive API docs at a well-known path to anyone.
Fix: gate the SwaggerModule.setup call behind env !== 'production' (or behind a dedicated ENABLE_SWAGGER flag), consistent with the JWT-secret production guard already present a few lines above it.
src/main.ts unconditionally calls
SwaggerModule.setup('api/docs', app, document)with noNODE_ENVcheck and no guard. The generated document includes every controller's route, every DTO's shape and validation rules (via@ApiProperty), and enough detail (endpoint list, required fields, enum values) to fully enumerate the API's attack surface — including the money-moving endpoints that #38 already flags as unauthenticated.Many teams deliberately disable or gate Swagger UI in production specifically to avoid handing an attacker a complete, browsable map of the API (parameter names, validation constraints, exact error-response shapes) with zero effort. There's no code path here that skips
SwaggerModule.setupforenv === 'production', so whatever gets deployed exposes full interactive API docs at a well-known path to anyone.Fix: gate the
SwaggerModule.setupcall behindenv !== 'production'(or behind a dedicatedENABLE_SWAGGERflag), consistent with the JWT-secret production guard already present a few lines above it.