API Security Testing

This package tests a REST or GraphQL API against the OWASP API Security Top 10 and gives you a report with CVSS severity, the exact requests that prove each finding, fixes and a retest. It is for SaaS founders and app teams whose mobile app, frontend or partners call an API that also holds customer data.

The flaws APIs actually ship with

• Object-level access: I log in as one user and request another user's records by changing the ID, which is the most common serious API bug.
• Authentication: JWT signature and expiry handling, tokens that still work after logout, and API keys passed in URLs where logs keep them.
• Responses that return fields the screen hides, such as emails, internal notes or password hashes.
• Mass assignment, where adding a role or plan field to a request quietly upgrades the account.
• Rate limits on login, one-time codes and password reset, checked with a small agreed number of requests.

Premium adds GraphQL depth and batching abuse, webhook signature and replay checks, and tests that one tenant can never read another tenant's data.

Scope and permission

Testing runs only after the API owner signs a written authorization naming the base URLs, endpoints and accounts in scope. Your API has to be yours: if it sits on AWS, Azure, Google Cloud, Supabase or Firebase, I follow that provider's published testing policy. Staging is preferred. Rate-limit checks are not load testing, and nothing in this package tries to slow down or overwhelm the service.

What makes it go faster

An OpenAPI file or a Postman collection, plus two test accounts per role, lets me spend the time on testing instead of mapping. Without documentation, the API mapping extra builds the collection from your app's traffic, and you keep it for your own regression tests. The report and that collection go only to you.