apicheck

11 checks across 6 OWASP API categories, with SARIF output and a non-zero exit code so it can block a CI build.

Overview

apicheck sits between running curl by hand and setting up a heavyweight scanner. Point it at a base URL and an OpenAPI spec and it discovers every endpoint, then runs independent checks against each one.

Checks cover missing security headers, endpoints that return data without auth, missing rate limits, broken object-level access (IDOR) using two identities, sensitive fields in responses, loose CORS, cookie flags, information disclosure, and privilege escalation between roles.

Scan-level checks look for undocumented endpoints that still respond and for deprecated operations that are still published.

Safety is a design rule: it never sends destructive requests, and a scan will not start without an explicit --i-am-authorized flag.

The problem

Most API security problems in business apps are boring and preventable, but teams rarely check for them before shipping.

What I did

I designed the check-module contract and built the CLI, spec discovery, HTTP client, every check, and the reporters.

1. Made each check an independent module with a shared contract so new checks are easy to add and test.
2. Mapped every finding to an OWASP API Top 10 category so results are easy to explain.
3. Added SARIF output and exit codes so the scan fits into existing CI dashboards.

The result

A small tool a backend team can run on every pull request to catch the obvious holes before a pentester does.

Features

• Auto-discovers endpoints from an OpenAPI / Swagger spec
• 11 checks mapped to OWASP API1, API3, API4, API5, API8 and API9
• Terminal, JSON and SARIF 2.1.0 reports
• Fails the build when findings meet a chosen severity
• Config file and .apicheckignore for accepted findings
• Strict TypeScript, non-destructive by design

Try it

Run inside a clone of the repository.