Two years ago, a developer added a test endpoint to speed up integration testing: POST /api/internal/test-auth. It accepts a hardcoded token (test-token-dev-2022) and returns a full admin session. The developer intended to remove it before production deployment. It was never removed.

The endpoint is not in the API documentation. It was not in scope for the last penetration test. It is not monitored in the security log analysis because analysts only alert on documented endpoint access patterns. It has been live in production for two years, accessible from the internet, known only to the original developer (who has since left the company).

An attacker fuzzes the API with a wordlist of common test/debug paths. /api/internal/test-auth returns HTTP 405 (Method Not Allowed) on GET — which signals the endpoint exists. They switch to POST with the hardcoded token from the exposed JavaScript source file and receive a full admin session token. They have administrator access to every user account in the system.