Should I expose Swagger / OpenAPI docs on my backend?

It depends on one question: is this hosted endpoint itself a public product surface, or is it internal plumbing?

Frameworks like FastAPI serve interactive docs out of the box - Swagger UI at /docs, ReDoc at /redoc, and the raw schema at /openapi.json. For a public, deliberately-open API, that is a feature. For an internal or admin backend (a logging control plane, a database proxy, a file-admin service) it is free reconnaissance: it hands anyone the full list of your endpoints, their parameters, and your admin and destructive paths, in a clean clickable UI, before they have tried anything. The endpoints still have their own auth, so this is information disclosure rather than a breach - but there is no upside to publishing the map of your internal surface.

The trap worth checking for. Many apps hide the visible /docs and /redoc pages and leave /openapi.json open. That JSON is the actual schema. Hiding the UI while leaving the schema open is not hiding anything. In FastAPI it is three arguments - docs_url=None, redoc_url=None, openapi_url=None - and the most common miss is the third. Verify all three return 404, not just the Swagger page.

Judge by the hosted endpoint, not by the code. Not by whether the endpoint names look harmless, and not by whether the project is open source. A backend can have its code published for others to self-host while its own hosted instance stays internal - in that case the schema for self-hosters already lives in the public repo, so hiding it on your live endpoint costs nothing.

Severity is INFO (recon, not a breach), so this is hardening rather than an emergency - but for an internal backend it is the cleanest recon an attacker gets for free. Full item: https://www.tigzig.com/security/backend.