Yes. Staging, beta and old version hosts often run the same API with weaker protections, and attackers find them with ordinary reconnaissance. Inventory every host with its environment and audience, scan the ones that are reachable, and retire the ones nobody uses.
What OWASP says
In API9:2023, OWASP describes attackers gaining access through old API versions or forgotten endpoints that remain running, unpatched and protected by weaker security. It adds that microservices and cloud deployments make unnecessary API hosts common, and that basic reconnaissance such as DNS enumeration can reveal them.
Its first example scenario is worth remembering. Rate limiting for password reset tokens was enforced in a separate component, not in the API itself. A researcher found a beta host running the same API without that protection and brute forced a six digit token to reset any user's password.
The lesson is simple: a protection that lives next to the API, not inside it, may not exist on the host you forgot.
What to list for each host
- Hostname and address.
- Environment: production, staging, beta, test.
- Intended audience: public, partner, internal.
- API version and retirement date.
- Whether real data is present.
- Owner.
OWASP's prevention list asks for the same: environment, intended audience and version, and it advises applying external API security protections to all exposed versions, not just production.
What to scan
| Host type | Scan for |
|---|---|
| Reachable from the internet | Full API scan, authentication and rate limit checks |
| Partner facing | Same, with the partner's credentials |
| Internal only | Dependency and configuration scan |
Compare findings between production and non production. A control missing on staging but present on production is a strong signal that the control lives in front of the API.
Data in non production
OWASP advises avoiding production data in non production environments, and applying the same controls if it cannot be avoided. Ask the owner directly whether a staging database was copied from production.
Take them down
If a host has no owner and no traffic, retire it in stages. If it must stay, put it behind authentication and a network allow list.
Try it yourself
Click through it at your own pace, or open it full screen. Look at what an API scan reports for a single host.
Quick check
Is a staging host a risk if it has fake data?
It can still be a path to production through shared credentials, and it may expose weaknesses in the same code. Treat it as in scope.
How do I find hosts I do not know about?
Compare DNS records, gateway config and cloud listings against your inventory, and investigate the differences.
Safeguard includes API security scanning and asset discovery, and you can run a free scan.
Sources
Last reviewed: 19 October 2026.
