API Security Scanner (Heuristics)
Paste an OpenAPI or JSON API spec to flag common smells: missing auth, empty security arrays, sensitive paths, and HTTP servers. Results are guidance only — this tool does not send requests, exploit APIs, or replace a professional assessment.
Runs entirely in your browser. Your data never leaves this device.
- Static OpenAPI heuristics
- Auth and path smell checks
- No network scanning
- Not a penetration test
- Local analysis only
How it works
- Paste an OpenAPI/JSON spec you are authorized to review.
- Run heuristic checks for missing auth, sensitive paths, and HTTP URLs.
- Treat results as guidance — not a pentest, exploit kit, or authorization to scan live hosts.
Key features
- Static OpenAPI heuristics
- Auth and path smell checks
- No network scanning
- Not a penetration test
- Local analysis only
FAQ
Is this a pentest tool?
No. It only runs static heuristics on specs you paste. It does not discover hosts or send probes.
Does it attack my API?
No network scanning or exploitation is performed. Analysis stays in your browser.
Can I use this on third-party APIs?
Only review specifications you own or have permission to assess. Do not use findings to attack systems without consent.
How to use results?
Treat findings as review prompts for your security process alongside professional testing.
Keep building
Related developer tools
Edit OpenAPI 3 JSON/YAML specs with basic validation and pretty output.
Send HTTP requests from your browser. CORS-limited; great for public APIs and quick checks.
Decode JWT header and payload, inspect claims and expiry. Decode only — no verification or cracking.