Fix Shadow API Exposure in Buffalo

Shadow APIs in Buffalo typically manifest through over-permissive resource routing. Buffalo's `app.Resource` automagically maps seven RESTful routes. If you define a Resource and don't explicitly prune the actions, you're hosting undocumented endpoints that bypass your security assumptions and leak internal logic to any scanner with a wordlist.

The Vulnerable Pattern

// actions/app.go
func App() *buffalo.App {
    app := buffalo.New(buffalo.Options{})
    // VULNERABILITY: This exposes List, Show, Create, Update, Destroy, New, and Edit.
    // Even if you only intended to allow 'Show', the other 6 endpoints are now live.
    app.Resource("/users", UsersResource{})
    return app
}

The Secure Implementation

To kill shadow APIs in Buffalo, stop relying on default resource mapping. Use the `.Only()` or `.Exclude()` methods on the Resource return value to restrict the attack surface. Always run 'buffalo routes' in your CI/CD pipeline to audit the routing table. If an endpoint doesn't appear in your documentation but appears in that list, you've found a shadow API. For high-security environments, skip Resources entirely and use manual `app.GET` or `app.POST` declarations to ensure every byte of the API surface is intentional.

// actions/app.go
func App() *buffalo.App {
    app := buffalo.New(buffalo.Options{})
// FIX 1: Use Only() to whitelist specific actions
app.Resource("/users", UsersResource{}).Only("Show", "Update")

// FIX 2: Explicit routing for absolute control (Hardening)
api := app.Group("/api/v1")
ur := UsersResource{}
api.GET("/profiles/{id}", ur.Show)

return app
}