Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in the query string, or an OAuth grant that RFC 9700 forbids. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
This page is the working piece. The full pack has everything below.
Finds the lines in an OpenAPI file that publish an endpoint with no authentication, an API key in the query string, or an OAuth grant RFC 9700 forbids.
An application-security consultant reading the same contract by hand bills $150-$250 an hour
Buy the full version — $29It reads an OpenAPI document as text, line by line, against 18 rules taken from the OWASP API Security Top 10 (2023), RFC 9700 and RFC 8594. It reports the line number, the rule and the reason for each finding: endpoints declared with no authentication, API keys in the query string, forbidden OAuth grants, plaintext servers and undocumented rate limits.
API platform and backend engineers who hand an OpenAPI file to something that acts on it: an AWS or Azure gateway that imports it, an SDK generator that ships it to customers, or a security reviewer who asks for it before a release. It is aimed at teams shipping APIs into regulated European and US markets.
Swagger Editor, JSON Schema validators and Spectral's stock ruleset check whether the document is well formed and internally consistent. A perfectly well-formed document can still say security: [] on a payments endpoint. Those tools have no opinion about that line; this one names it, cites the OWASP category, and points at the row number.
Free: audit the file open in your editor against all 18 rules, with every finding, line number and rule reference shown. Nothing is hidden or counted down. A licence adds a different job: sweeping every OpenAPI document in the workspace at once, and writing a dated CSV, JSON or HTML report you keep alongside the release.
An application-security consultant reading the same contract bills roughly $150 to $250 an hour, and the OAuth grant, scope and mass-assignment questions are the slow part of that hour. A full external API penetration test is a larger engagement again. The licence is $29 once, with a seven-day full refund.
One question, answered by the person who built it. Your email only if you want the answer sent.