Missing authentication on /metrics

Description

The Prometheus /metrics endpoint is exposed without authentication, leaking internal telemetry and topology.

mux.Handle("/metrics", promhttp.Handler()) // no auth

Details

Severity

high

CVSS

7.5

CVE

—

CWE

CWE-306

File

services/api/router.go

Status

open

Remediation

No remediation generated yet. The engineer agent proposes a patch when this finding is triaged.