I'm about to launch an app I built with an AI coding tool. I want to check for things on the public internet that shouldn't be: database admin interfaces, test and debug endpoints, staging consoles, seed data, anything wired to the public that was never meant to be there.

List every URL this app exposes that is not part of the product a customer uses: admin interfaces, debug endpoints, test routes, seed data. Which of those are reachable from the public internet?

A good answer is the list, with the URL a stranger would use for each, for example "the database admin UI is live at /phpmyadmin", and the fix to take each one off the public internet, or put it behind authentication.