🔄 Preview: [TT-17927] Update documentation for master - #2797
Draft
probelabs[bot] wants to merge 486 commits into
Draft
🔄 Preview: [TT-17927] Update documentation for master#2797probelabs[bot] wants to merge 486 commits into
probelabs[bot] wants to merge 486 commits into
probelabs / Visor: security
failed
Aug 27, 2026 in 46s
🚨 Check Failed
security check failed because fail_if condition was met.
Details
📊 Summary
- Total Issues: 4
- Critical Issues: 1
- Error Issues: 1
- Warning Issues: 2
🔍 Failure Condition Results
Failed Conditions
- global_fail_if: output.issues && output.issues.some(i => i.severity === 'critical' || i.severity === 'error')
- Severity: ❌ error
Issues by Category
Security (3)
⚠️ snippets/dashboard-config.mdx:162 - The documentation forstorage.main.postgres.max_open_connectionsspecifies a default value of0, which signifies unlimited open connections to the database. This is an insecure default that can lead to resource exhaustion on the database server, creating a Denial of Service (DoS) vulnerability. The same issue is present for theanalytics,logs, anduptimestorage configurations.- 🚨 snippets/x-tyk-gateway.mdx:1854 - The new
codefield for custom middleware allows for the execution of inline, base64-encoded Javascript directly from an API definition. This feature introduces a critical security risk. If an attacker gains the ability to modify API definitions, they can inject arbitrary code, leading to Remote Code Execution (RCE) on the gateway. The documentation lacks any warning about the severe security implications of enabling and using this feature. ⚠️ swagger/gateway-swagger.yml:1616 - The newexpand=truequery parameter on the MCP proxy endpoint (POST /tyk/mcp/apis) can return the full derived tool catalogue and structure of a backend REST API. This functionality could be abused to expose sensitive information about internal API structures, including paths, methods, and parameters. While this is an authenticated admin endpoint, it poses an information disclosure risk if an admin account is compromised or in an insider threat scenario. A similar risk exists for theGET /tyk/mcp/apis/{apiId}endpoint and the corresponding/api/apis/mcpendpoint inswagger/dashboard-swagger.yml.
Logic (1)
- ❌ system:0 - Global failure condition met: output.issues && output.issues.some(i => i.severity === 'critical' || i.severity === 'error')
Powered by Visor from Probelabs
💡 TIP: You can chat with Visor using /visor ask <your question>
Annotations
Check warning on line 165 in snippets/dashboard-config.mdx
probelabs / Visor: security
security Issue
The documentation for `storage.main.postgres.max_open_connections` specifies a default value of `0`, which signifies unlimited open connections to the database. This is an insecure default that can lead to resource exhaustion on the database server, creating a Denial of Service (DoS) vulnerability. The same issue is present for the `analytics`, `logs`, and `uptime` storage configurations.
Raw output
Update the documentation to recommend a specific, safe, non-zero default value for `max_open_connections`. Alternatively, add a prominent warning advising administrators to configure a sensible limit based on their database capacity and expected load to mitigate the risk of resource exhaustion.
Check failure on line 1858 in snippets/x-tyk-gateway.mdx
probelabs / Visor: security
security Issue
The new `code` field for custom middleware allows for the execution of inline, base64-encoded Javascript directly from an API definition. This feature introduces a critical security risk. If an attacker gains the ability to modify API definitions, they can inject arbitrary code, leading to Remote Code Execution (RCE) on the gateway. The documentation lacks any warning about the severe security implications of enabling and using this feature.
Raw output
Add a prominent security warning to the documentation for the `code` field. The warning should explicitly state that this feature can be used to execute arbitrary code on the gateway and must be treated with extreme caution. It should recommend that access to modify API definitions containing this field be strictly limited to highly privileged and trusted administrators, and that its use should be carefully audited.
Check warning on line 1622 in swagger/gateway-swagger.yml
probelabs / Visor: security
security Issue
The new `expand=true` query parameter on the MCP proxy endpoint (`POST /tyk/mcp/apis`) can return the full derived tool catalogue and structure of a backend REST API. This functionality could be abused to expose sensitive information about internal API structures, including paths, methods, and parameters. While this is an authenticated admin endpoint, it poses an information disclosure risk if an admin account is compromised or in an insider threat scenario. A similar risk exists for the `GET /tyk/mcp/apis/{apiId}` endpoint and the corresponding `/api/apis/mcp` endpoint in `swagger/dashboard-swagger.yml`.Raw output
The API documentation for endpoints supporting the `expand=true` parameter should include a security note. This note should warn about the potential for sensitive information disclosure regarding backend service architecture and recommend that access to this functionality be tightly controlled and usage be logged and audited, especially in production environments.
Loading