Summary
system-profiler applies auth middleware to /stats/*, /host/*, /containers/*, and /services/*, but not to the root /stats route itself. In development, the service is also published on host port 8787.
Why this matters
/stats may be reachable without the expected token check- The exposed dev port makes accidental access easier while testing
- This creates confusion about which profiler endpoints are actually protected
Evidence
system-profiler/src/index.ts:24-28system-profiler/src/routes/index.ts:9docker-compose.override.yml:45-46
Suggested fix
Apply auth to both the collection root and nested paths, or mount protected routers beneath an already-authenticated parent. Confirm the intended dev exposure model and document it clearly.
Acceptance criteria
/stats requires the same auth as nested profiler endpoints- Route protection is consistent across stats, host, containers, and services
- Dev exposure is intentional and documented
Summary
system-profilerapplies auth middleware to/stats/*,/host/*,/containers/*, and/services/*, but not to the root/statsroute itself. In development, the service is also published on host port8787.Why this matters
/statsmay be reachable without the expected token checkEvidence
system-profiler/src/index.ts:24-28system-profiler/src/routes/index.ts:9docker-compose.override.yml:45-46Suggested fix
Apply auth to both the collection root and nested paths, or mount protected routers beneath an already-authenticated parent. Confirm the intended dev exposure model and document it clearly.
Acceptance criteria
/statsrequires the same auth as nested profiler endpoints