openapi-hardener

Enforce strict validation rules on OpenAPI, JSON Schema, Zod, Joi, and Pydantic schemas.

18|1|Updated Mar 12, 2026

Search Tags:#pydantic #openapi #owasp #zod #schema validation #json schema #api security

Ready to run

npx skills add https://github.com/apisec-inc/apisec-skills --skill openapi-hardener

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: openapi-hardener
Source: https://github.com/apisec-inc/apisec-skills/tree/main/skills/openapi-hardener
Command: npx skills add https://github.com/apisec-inc/apisec-skills --skill openapi-hardener

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill prevents security vulnerabilities and data leaks by ensuring API schemas (OpenAPI, JSON Schema, Zod, etc.) are strictly defined, preventing mass assignment, data exposure, and injection attacks.

Core Features & Use Cases

Schema Hardening: Enforces constraints like additionalProperties: false, required fields, and data type validation.
Vulnerability Prevention: Mitigates OWASP API3:2023 (Broken Object Property Level Authorization) and other schema-related risks.
Use Case: When defining an API endpoint for user creation, this Skill ensures that only permitted fields are accepted as input and that sensitive fields like passwordHash are never returned in the response.

Quick Start

Use the openapi-hardener skill to review and tighten the provided OpenAPI specification for security.

Frequently Asked Questions about openapi-hardener

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent mass assignment vulnerabilities in an OpenAPI specification?▼

To prevent mass assignment in OpenAPI, enforce strict schema validation rules like `additionalProperties: false` and define `required` fields to ensure only permitted inputs are accepted.

What is OWASP API3:2023 and how does schema validation mitigate it?▼

OWASP API3:2023 is Broken Object Property Level Authorization. Schema validation mitigates it by enforcing `readOnly` and `writeOnly` properties, preventing sensitive data leakage and unauthorized field modifications.

Can I apply OpenAPI security hardening rules to Pydantic or Zod schemas?▼

Yes, schema hardening applies to Pydantic, Zod, and Joi formats. The process enforces strict constraints like string and numeric limits to prevent injection attacks and data exposure across these definitions.

How do I stop sensitive fields like passwordHash from leaking in JSON Schema responses?▼

Stop sensitive field leakage in JSON Schema by marking them as `readOnly`. This ensures fields like `passwordHash` are never returned in API responses, aligning with strict data exposure prevention rules.

What is the best way to secure API contracts against data leakage and injection?▼

The best way to secure API contracts is enforcing strict schema constraints across formats like OpenAPI and JSON Schema, applying `additionalProperties: false` and data type validation to block injection attacks.

Do I need to manually define required fields for every API endpoint to prevent data exposure?▼

Yes, defining `required` fields for API endpoints is necessary. Strict schema validation relies on explicitly declared properties to block mass assignment vulnerabilities and prevent unauthorized data exposure.