Information Disclosure: Swagger UI was enabled in all environments, exposing API documentation and potentially sensitive endpoint details to unauthorized users. The fix scoped it to development only, but any future addition of similar tools could regress this.