VulnAPI
What it is
VulnAPI is a free, open-source tool for dynamic security testing of APIs. It scans REST, OpenAPI, and GraphQL targets, as well as requests made through a curl-like command-line interface. Its product page says it detects all ten OWASP API Security Top 10 categories out of the box, and lists API discovery, authentication, authorization, input-validation, and business-logic testing. Reports identify the risk level, vulnerability, description, and affected operation. Findings also include the request that triggered the issue and remediation steps in plain English. Teams can tailor assessments to their environments and run scans through GitHub Actions, GitLab CI, or Jenkins. VulnAPI is self-hosted, with pre-built binaries and installation instructions for Linux, Windows, and macOS; Docker is also available. The scanner collects anonymous counts of scans and detected vulnerabilities, including severity, but users can opt out with a command-line flag. Proxy settings can be supplied through HTTP_PROXY or HTTPS_PROXY or a --proxy argument. The MIT-licensed software is free to use, modify, and distribute for educational and testing purposes.
For and against
For
- Covers all ten OWASP API Security Top 10 categories.
- Supports REST, OpenAPI, GraphQL, and curl-like requests.
- Reports include triggering requests and remediation steps.
- Integrates with GitHub Actions, GitLab CI, and Jenkins.
Against
- Requires self-hosted deployment.
- Anonymous scan statistics are collected unless users opt out.
The verdict
VulnAPI brings API discovery and several types of security testing into a free, self-hosted scanner. Its detailed findings and CI/CD integrations are useful to teams prepared to install and manage it themselves.
Who it suits
VulnAPI suits security-minded teams that want to assess APIs in a self-hosted setup. It may fit teams that need to incorporate scans into CI/CD pipelines or tailor checks to their environments.
Plans and prices
Open source (MIT License)
Free to use, modify, and distribute for educational and testing purposes
Read 3 Oct 2026 · github.com
On the record
- CI/CD integrations
- The maker lists GitHub Actions, GitLab CI, and Jenkins as supported CI/CD pipeline integrations.cerberauth.com · read 3 Oct 2026
- Custom scans
- The product page says teams can tailor security assessments to their requirements and environments.cerberauth.com · read 3 Oct 2026
- Installation
- Pre-built binaries and installation instructions are provided for Linux, Windows, and macOS, with Docker also available.cerberauth.com · read 3 Oct 2026
- OWASP coverage
- The product page says VulnAPI detects all ten OWASP API Security Top 10 categories out of the box.cerberauth.com · read 3 Oct 2026
- Proxy support
- The scanner supports proxy configuration through HTTP_PROXY or HTTPS_PROXY environment variables or a --proxy argument.github.com · read 3 Oct 2026
- Remediation guidance
- The product page says findings include a plain-English description, the triggering request, and concrete remediation steps.cerberauth.com · read 3 Oct 2026
- Reports
- Scan reports include the risk level, vulnerability, description, and operation where the finding was detected.cerberauth.com · read 3 Oct 2026
- Scan methods
- It scans APIs through a curl-like CLI, OpenAPI contracts, or a GraphQL endpoint.cerberauth.com · read 3 Oct 2026
- Support channel
- The repository invites users to request additional vulnerability checks or best practices by opening an issue or submitting a pull request.github.com · read 3 Oct 2026
- Target audience
- The product page describes VulnAPI as built for security-minded teams.cerberauth.com · read 3 Oct 2026
- Telemetry
- The scanner collects anonymous usage data about scan counts and detected vulnerability counts and severity; users can opt out with a command-line flag.github.com · read 3 Oct 2026
- What it does
- VulnAPI is an open source dynamic application security testing tool that scans APIs for vulnerabilities and security risks.cerberauth.com · read 3 Oct 2026
