audit-api

Audit Hono, Express, or Next.js API routes for auth gaps and data exposure.

Updated Feb 23, 2026

Search Tags:#security #authentication #api-design #data-exposure #api-audit #route-discovery

Ready to run

npx skills add https://github.com/0xHoneyJar/construct-hardening --skill audit-api

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: audit-api
Source: https://github.com/0xHoneyJar/construct-hardening/tree/main/skills/audit-api
Command: npx skills add https://github.com/0xHoneyJar/construct-hardening --skill audit-api

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

API teams frequently struggle to secure routes and prevent data leakage due to inconsistent auth enforcement, misconfigurations, and missing rate-limiting, leading to security risk and compliance gaps.

Core Features & Use Cases

Route discovery across frameworks (Hono, Express, Next.js API)
Auth gate auditing for missing or weak protections
Data exposure and error handling checks
Rate-limiting and input validation review
Output: route table and structured findings for remediation

Quick Start

Run the audit against your API codebase to generate a structured findings report.

Frequently Asked Questions about audit-api

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit API routes for authentication gaps and data exposure?▼

To audit API routes for authentication gaps and data exposure, run an automated audit against your codebase. It performs route discovery and auth gate checks to identify missing protections and output a structured findings report.

What is automated API route discovery for security auditing?▼

Automated API route discovery is the process of scanning a codebase to map endpoints and check for input validation weaknesses. It reviews auth gates, data exposure, and rate limits without executing live requests.

Can I audit API routes in Hono, Express, and Next.js projects?▼

Yes, you can audit API routes in Hono, Express, and Next.js projects. The audit supports TypeScript and JavaScript codebases, reviewing both new and legacy endpoints for rate-limiting and error handling checks.

What's the best way to review input validation and rate limiting across an API?▼

The best way to review input validation and rate limiting across an API is to perform a static codebase audit. This identifies misconfigurations and missing protections, producing a route table and structured findings for remediation.

Does an API security audit execute live requests against my endpoints?▼

No, an API security audit does not execute live requests against your endpoints. It statically analyzes your TypeScript or JavaScript codebase to perform route discovery and validate auth gates without touching the live server.