API Security Scanner

01Overview

APIs are where modern breaches happen — and traditional web scanners largely miss the class of flaws that live at the API layer: broken object-level authorization, mass assignment, unrestricted resource consumption, and shadow endpoints. The API Security Scanner closes that gap with a static-analysis engine that discovers, audits, and reports API security vulnerabilities and misconfigurations across REST, GraphQL, gRPC, OpenAPI/Swagger specs, and API gateway configurations, with every finding mapped to the OWASP API Security Top 10 (2023).

It ships as a single, zero-dependency Python file that runs on pure 3.10+ standard library across Windows, macOS, and Linux — no pip installs, no services, no cloud. Point it at a file or a whole project tree and it fingerprints your API stack (frameworks, protocols, auth methods, gateways, databases), runs 112 regex-backed detection rules across 22 categories, and emits coloured console output, machine-parseable JSON, and an interactive HTML report. A CI-friendly exit code (1 on any CRITICAL/HIGH) makes it a drop-in pull-request gate.

The scanner is deliberately broad in surface: it reads Python, JavaScript/TypeScript, Java, Go, Ruby, and PHP source; GraphQL schemas and Protobuf service definitions; OpenAPI specs, Nginx/Kong/Envoy gateway configs, Dockerfiles, Kubernetes manifests, and .env files — applying the right rule packs per file type. Each finding carries a severity, CWE reference, actionable remediation, and mappings to PCI-DSS v4.0, GDPR, HIPAA, and DORA alongside OWASP.

It's built for AppSec engineers, API platform teams, and security-minded developers who want fast, offline, dependency-free API risk visibility they can wire into a pipeline in minutes rather than standing up a scanning platform.

02Key Capabilities

03Architecture

The scanner is a single self-contained Python module organized as a bank of module-level rule dictionaries feeding a regex SAST engine. A file dispatcher routes each file by type to the appropriate scanner method, which applies the relevant rule packs line-by-line; matches become Finding dataclasses that are aggregated, severity-sorted, and rendered to console, JSON, or HTML.

04Project Structure

05Security Controls

06Technology Stack

Language

Python 3.10+ (uses union-type syntax and modern typing)

Dependencies

Zero external — pure standard library (re, os, argparse, json, datetime, dataclasses, pathlib, textwrap, hashlib, typing)

Analysis engine

Custom regex-based SAST over per-file-type rule packs

Reporting

ANSI-coloured console, JSON (via json/dataclasses.asdict), and self-contained HTML with inline CSS/JS

Testing

Fixture-based — 9 intentionally vulnerable sample files under tests/samples/ run through the scanner (no third-party test framework)

CI

Ready-to-use GitHub Actions and GitLab CI snippets documented in README; exit-code gate on CRITICAL/HIGH

Deployment

Single-file distribution — git clone or curl the one .py file; runs on Windows, macOS, Linux

License

MIT

07Quick Start

$ python api_security_scanner.py --version   # verify: API Security Scanner v1.0.0
$ python api_security_scanner.py /path/to/your/api-project   # scan a whole project tree
$ python api_security_scanner.py ./my-api --json report.json --html report.html   # machine + stakeholder reports
$ python api_security_scanner.py ./my-api --severity HIGH   # only CRITICAL and HIGH findings
$ python api_security_scanner.py tests/samples/ --verbose   # run against the bundled vulnerable fixtures
$ python api_security_scanner.py openapi.yaml   # scan a single OpenAPI spec, GraphQL schema, .proto, nginx.conf, or .env

08Compliance & Frameworks

09Integrations & Outputs