Info-disclosure finding is just my public API docs

Report flags 'sensitive endpoint disclosure' pointing at /docs, which is my intentionally public Swagger UI. Not everything discoverable is a leak.