A developer hired a penetration tester to attack his FastAPI staging environment and within 45 minutes the tester exploited leaked OpenAPI docs, an unprotected IDOR endpoint, a hard-coded JWT secret, a raw-SQL reporting endpoint, and lax webhook verification to gain full admin access and dump the database. The report lists critical flaws and warns of exposed production keys in staging.

• Auto-generated OpenAPI/Swagger docs left public let the tester map the entire schema and find a forgotten admin-role endpoint in just 8 minutes.
• An unprotected GET /users/{user_id} endpoint let him swap IDs to steal the admin's email, bcrypt hash, and API keys.
• A hardcoded JWT secret found via Google cache of a deleted GitHub issue let him forge tokens and impersonate admin.
• A raw f-string SQL "reports" endpoint was UNION-injectable, dumping every user's credentials and Stripe IDs, and he then hijacked the Stripe webhook to redirect payments—all in 45 minutes total.