Customer Swagger Docs Exposed in Production

// bootstrap.utils.ts L164-L167
if (!environmentService.isInProdEnvironment()) {
  initSwagger(app);           // Internal swagger, gated ✓
}
initCustomerSwagger(app);     // Customer swagger, ALWAYS exposed, including production

Frontend / on-chain mitigation analysis: The Swagger UI at /v1/customer-docs provides a complete endpoint map to attackers. Considering the customer API is designed for B2B partner consumption, this may be intentional, but should be verified.

Complete endpoint enumeration without authentication, enabling targeted attack planning.

If intentional, ensure no internal endpoints leak through module imports. If not, gate behind the same environment check.

Accepted by team, intentional public API surface for partner client generation; CI gates already prevent admin/oracle/lending/webhook paths from leaking into the customer spec.