Directus exposes a /server/info endpoint without authentication by
design, returning project metadata (name, branding, public registration
status) and license entitlement flags (e.g. whether AI translations or
production mode are enabled). Confirmed against a live directus/directus
instance that the current version no longer includes an exact version
string in this unauthenticated response, but the endpoint still reliably
fingerprints a live Directus instance and leaks project/tenant naming and
licensing configuration that operators sometimes expect to be private.
Log in to view the POC file snapshot cached by Shenlong Bot
Log in to view