{ "date": "2026-10-13", "block": "12.5.202", "runtime": { "backend": "ux-lock200", "frontend": "ux-portal199", "portal": "1.3.1" }, "cases": [ { "path": "/api/servers", "readerStatus": 200, "unauthenticatedStatus": 401, "nonemptySecretFields": 0, "knownTestSecretsPresent": false }, { "path": "/api/servers/:id", "serverId": 1, "readerStatus": 200, "nonemptySecretFields": 0 }, { "path": "/api/servers/:id", "serverId": 2, "readerStatus": 200, "nonemptySecretFields": 0 }, { "path": "/api/alerts", "readerStatus": 200, "unauthenticatedStatus": 401, "nonemptySecretFields": 0, "knownTestSecretsPresent": false }, { "path": "/api/alerts/outbox", "readerStatus": 200, "unauthenticatedStatus": 401, "nonemptySecretFields": 0, "knownTestSecretsPresent": false }, { "path": "/api/backups/storage", "readerStatus": 200, "unauthenticatedStatus": 401, "nonemptySecretFields": 0, "knownTestSecretsPresent": false }, { "path": "/api/uptime/settings", "readerStatus": 200, "unauthenticatedStatus": 401, "nonemptySecretFields": 0, "knownTestSecretsPresent": false }, { "path": "/api/uptime/speed-probes", "readerStatus": 200, "unauthenticatedStatus": 401, "nonemptySecretFields": 0, "knownTestSecretsPresent": false }, { "path": "/api/traffic/flow/settings", "readerStatus": 200, "unauthenticatedStatus": 401, "nonemptySecretFields": 0, "knownTestSecretsPresent": false }, { "path": "/api/geoip", "readerStatus": 200, "unauthenticatedStatus": 401, "nonemptySecretFields": 0, "knownTestSecretsPresent": false }, { "path": "/api/evobgp/settings", "readerStatus": 403, "unauthenticatedStatus": 401, "nonemptySecretFields": 0, "knownTestSecretsPresent": false }, { "path": "/api/scheduler/status", "readerStatus": 403, "unauthenticatedStatus": 401, "nonemptySecretFields": 0, "knownTestSecretsPresent": false }, { "name": "configured Telegram DTO", "rawBotTokenPresent": false } ], "actualPortalJWT": true, "appReadOnly": true, "configurationWrites": 0, "nativeCallsRequested": 0, "cleaned": true, "bounds": [ "Current configured DTOs only; empty S3/EvoBGP secrets not proof for arbitrary populated credentials", "Does not audit binary backups/downloads/certificates, embedded credentials in arbitrary error messages, or every application endpoint" ] }