[40%] Railway app API discovery

[github-actions]

Title

Railway app API discovery

Target

kurs.onecode.de

Class

MISCONFIG

Confidence

40/100

Reasoning

Railway-hosted app with /login path; likely has API endpoints behind auth

Evidence needed

200/401/403 responses on common API paths

Verify steps

GET https://kurs.onecode.de/api/, GET https://kurs.onecode.de/v1/, GET https://kurs.onecode.de/graphql, GET https://kurs.onecode.de/swagger

Impact

API endpoint discovery, potential auth bypass (Medium-High)

Testability

PASSIVE

model: bigpickle · auto-synced from leads/lead-*.md