Open any modern website, hit F12, click the Network tab, and reload. You'll see dozens of requests to URLs like /api/users/me or /graphql. These are the public entry points the app itself uses. Seeing them is normal and intended.
An endpoint is like a door on a building. Finding a door doesn't mean you can walk in. The door has a lock. The lock is called authentication.
Common misconception
"I found their secret API by opening the network tab, I could hack them."
Reality
The API isn't secret. It's how the app you're using talks to the server. Whether you can do anything harmful with it depends entirely on how it's secured.
Authentication (authn): who are you? Handled by passwords, session cookies, JWTs, OAuth tokens, API keys.
Authorization (authz): what are you allowed to do? Handled by roles, permissions, scopes, and access control checks on each request.
An endpoint call typically looks like this:
GET /api/users/me
Authorization: Bearer eyJhbGciOiJIUzI1NiIs...
Without the token, the server responds 401. With a valid token for user 42, asking for /api/users/99/private should respond 403 (that's authorization working).
Many games built in Unity use networked services: matchmaking, leaderboards, inventory, purchases. Finding one of these endpoints by proxying game traffic or reading the assembly does not mean the game is exploitable.
The game's backend still has:
Authentication tokens tied to your account
Server side validation of every action
Rate limiting
Anti cheat monitoring
Logging that flags suspicious patterns
The client is not the source of truth. Sending a modified request usually just gets your request rejected or your account flagged.
JavaScript that runs in your browser was downloaded to your computer. Reading it is not intrusion, it's just reading a file your own browser fetched.
Minified or obfuscated JS is still just JS. You can un-minify it with any pretty printer. Companies do this to reduce bundle size, not to keep secrets, because it doesn't keep secrets.
Reality
Real secrets (database passwords, admin keys, encryption keys) live on the server, which you cannot read. If you can read a secret in the JS bundle, the mistake was shipping it there in the first place.
Open source software is intentionally published. If a company uses React, Postgres, or the Linux kernel, that code being public says nothing about the company's own proprietary code.
Licenses like MIT, Apache 2.0, and GPL exist specifically so this code can be shared and used. That is the point.
Responsible disclosure means finding a bug and telling the vendor privately so they can fix it. Exploitation means using it to harm people. These are very different activities.
Chrome DevTools, Firefox Developer Tools, Postman, cURL, Wireshark, mitmproxy, Fiddler. These are standard tools every working developer uses. Opening one doesn't make you a hacker any more than opening a wrench makes you a car thief.
APIs cap how many requests a client can make in a window. This prevents brute forcing, denial of service, and scraping. Hitting a rate limit is not bypassing anything, it's the system doing exactly what it's supposed to do.
HTTP/1.1 429 Too Many Requests
Retry-After: 60
X-RateLimit-Limit: 100
X-RateLimit-Remaining: 0
Most beginner questions are answered directly in the official docs. The error message you're looking at usually says exactly what's wrong. Reading docs is not glamorous, but it's what separates someone who solves their own problems from someone who waits for help.
You can see an endpoint. You can send it a request. Neither of those things means you can make it do something it wasn't designed to do. Endpoints typically have:
Input validation (rejecting malformed data)
Input sanitization (preventing injection)
Authentication and authorization (see the earlier article)
Rate limiting and abuse detection
Structured logging that flags anomalies
Demonstrating that an endpoint exists is not demonstrating a security issue. If you actually find a real vulnerability, use responsible disclosure. Don't post it as a Discord flex.