RECON-SALONS — Salon/Barbershop Recon

When to Use

Use when the target scope includes hair salons, barbershops, nail salons, spas, waxing studios, or med-spas. These businesses rely heavily on third-party booking platforms that handle customer PII (names, phone numbers, email addresses). The booking API exposure, customer data leakage, and authentication gaps are common findings in this sector.

Quick Reference

• Common CMS: WordPress, custom PHP, Wix, Squarespace
• Common platforms: Booksy, Vagaro, Square Appointments, Mindbody, Fresha, StyleSeat, Timely
• Key endpoints: /book, /booking, /appointments, /services, /pricing, /staff
• API surfaces: Booksy API, Vagaro API, Square API, Mindbody API v6
• Key findings: Booking API exposing customer PII, appointment data without auth, staff schedule IDOR

Step-by-Step