Apache DevLake is an open-source dev data platform that ingests, analyzes, and visualizes the fragmented data from DevOps tools to extract insights for engineering excellence, developer experience, and community growth. Apache DevLake is designed for developer teams looking to make better sense of their development process and to bring a more data-driven approach to their own practices. You can ask Apache DevLake many questions regarding your development process. Just connect and query.
Apache DevLake exposes an unauthenticated data-source connection-test endpoint whose request body supplies the target "endpoint" URL, which the server then fetches with no authentication and no private-IP/metadata filtering (the optional ENDPOINT_CIDR_BLACKLIST is disabled by default and only matches literal IPs, so any hostname bypasses it). A remote attacker who can reach the API can therefore coerce the server into issuing HTTP/HTTPS requests to arbitrary internal hosts, read cloud-metadata and internal HTTP services, and port-scan the internal network. By default the upstream response body is reflected back in the error.