Compound WireCOMPOUND12 September 2026
@mockoon/commons-server: Default admin API enables state/secret theft
@mockoon/commons-server: Default admin API enables state/secret theft
Mockoon's admin API is enabled by default on the same Express listener as user routes, with wildcard CORS and mutating methods exposed. A mock server can become a state-and-secrets endpoint if it is reachable. #dev