Directus exposes a /server/info endpoint without authentication by
design, returning project metadata (name, branding, public registration
status) and license entitlement flags (e.g. whether AI translations or
production mode are enabled). Confirmed against a live directus/directus
instance that the current version no longer includes an exact version
string in this unauthenticated response, but the endpoint still reliably
fingerprints a live Directus instance and leaks project/tenant naming and
licensing configuration that operators sometimes expect to be private.
登录后查看神龙缓存的 POC 文件快照
登录查看