Assets · apps and APIs on your verified domains
The apps we test more deeply than the hosts they run on
4 apps · 3 web, 1 API · 1,466 routes known · one spec, 64 endpoints · 1 without a repository
Public API · api.tessellatepay.com · proven by our own template
The public API runs on a server we proved exploitable
Next.js 14.1.0: Server-Side Request Forgery in Server Actions. Our template made api.tessellatepay.com call out to us, so anyone calling the API can reach what the server can. A rescan started at 10:19 will say whether this morning's release fixed it.
Visibility
How much of each app can we see?
1,466 routes we know · 22 answer without signing in · by first path segment
- Answers signed out
- Behind the sign-in or a key
- Declared in a spec
- Gone
- Merchant dashboardapp.tessellatepay.com
21 of 1,401 answer signed out · 1,379 behind the sign-in · 1 gone
- Public APIapi.tessellatepay.com
1 of 65 answer signed out · 64 declared in its spec
- Merchant onboardingmerchants.tessellatepay.comBehind the sign-in: the onboarding steps, document upload and the approval status page
/sign-in
Only its sign-in page answers without a login, so that’s all we’ve seen.
- Agent bankingagents.tessellate.ngBehind the sign-in: cash-in, cash-out, float top-ups and the agent's daily statement
/sign-in
Only its sign-in page answers without a login, so that’s all we’ve seen.