__hot__ | X-dev-access Yes

| Scenario | Explanation | |----------|-------------| | | An organization uses this header to bypass rate limiting, logging, or security checks for internal dev tools. | | Mock or proxy server | Tools like Postman, WireMock, or custom proxies might use x-dev-access: yes to return mock data or disable real side effects. | | Low-code / no-code platforms | Some internal systems (e.g., Retool, Budibase) allow custom headers to toggle dev-mode for API connectors. | | Legacy or niche SaaS | A few B2B services have undocumented headers to enable developer sandbox features (e.g., skipping email verification). |

If you have access to network packet captures or a WAF (Web Application Firewall), run a query looking for the string x-dev-access in HTTP headers over the last 30–90 days. x-dev-access yes