api-audit

Run the audit in full mode to inventory all endpoints and score them across dimensions D1-D12, including input validation, auth coverage, and OWASP API Security checks like BOLA and mass assignment. Every finding cites a file and line number with severity and a suggested fix.

D12 checks BOLA (object-level authorization), BOPLA excessive data exposure and mass assignment, BFLA function-level authorization, JWT algorithm confusion, sensitive business flow abuse, shadow endpoints, and GraphQL introspection/depth. It activates with the --security flag or automatically when an auth surface is detected.

Yes, stack detection covers NestJS controllers, Cloudflare Workers via wrangler configs, FastAPI routers, Hono, Next.js, and frontend patterns like React Query and raw fetch/axios. Endpoint discovery adapts per stack and cross-checks against OpenAPI specs when present.

GET-only probing runs on STANDARD tier and above, but production targets are refused by default; only localhost, staging, or sandbox environments confirmed by the user are probed. Auth tokens must be supplied by the user, and all logged responses are scrubbed of credentials and PII.

Critical gates trigger auto-fail when D1=0 (no input validation), D9<8 (auth gaps on mutations), D3<3 with over 10K rows (unbounded queries), D11=0 (breaking contract change), or any confirmed BOLA, BFLA, or mass-assignment finding on a data-bearing endpoint when D12 is active.

Use the --static flag when no running server is available or you only want code-level analysis. It skips Phase 2 GET probing entirely while still performing endpoint inventory, dimension scoring, and cross-cutting contract analysis.