Results for “owasp-api4”

Systematically audits a web application against the OWASP 2021 Top 10, producing severity-rated, file-level findings with fixes for each category.

Configure Google Apigee security policies including JSON/XML threat protection, OAuth 2.0, SpikeArrest, and Advanced API Security to defend against OWASP API Top 10 threats.

Systematically assess REST and GraphQL API endpoints against the OWASP API Security Top 10 risks using automated and manual testing techniques.

Refreshes the local OWASP Cheat Sheet Series cache for the current project's language, checking GitHub for updates and fetching changed sheets.

OWASP Top 10 audit checklists for Web Applications (2021), APIs (2023), and Mobile (2024). Use when performing any security review, PR review, or codebase audit touching web, mobile, or API code.

Perform static audit and dynamic conformance scanning of OpenAPI specifications using the 42Crunch platform to identify OWASP API Security Top 10 vulnerabilities.

Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic using the OWASP API Security Top 10 framework.

Authorized security assessment of REST, GraphQL, WebSocket, and SOAP APIs covering discovery, authentication, authorization, rate-limiting, and CI/CD integration.

Integrates OWASP ZAP for Dynamic Application Security Testing in CI/CD pipelines, configuring baseline, full, and API scans, interpreting findings, tuning policies, and establishing quality gates in GitHub Actions and GitLab CI.

Security vulnerability scanner and OWASP compliance auditor for codebases. Dependency scanning (npm audit, pip-audit), secret detection (high-entropy strings, API keys), SAST for injection/XSS vulnerabilities, and security posture reports. Activate on 'security audit', 'vulnerability scan', 'OWASP', 'secret detection', 'dependency check', 'CVE', 'security review', 'penetration testing prep'. NOT for runtime WAF configuration (use infrastructure tools), network security/firewalls, or compliance certifications like SOC2/HIPAA (legal/organizational).

Automates REST API security testing using the OWASP ZAP Python SDK, running active scans, SQL injection probes, and XSS tests against OpenAPI specs with structured vulnerability reports.

Scans a single file against the OWASP Top 10:2025, tracks cross-file connections, and maintains a persistent findings record.

OWASP security guidelines and Top 10 vulnerabilities USE WHEN: user mentions "OWASP", "security audit", "vulnerability scan", asks about "injection", "XSS", "CSRF", "access control", "authentication security" DO NOT USE FOR: OWASP Top 10:2025 specific - use `owasp-top-10` instead

Tests APIs for excessive data exposure where endpoints return more data than the client application needs, relying on the frontend to filter sensitive fields. Maps to OWASP API3:2023 Broken Object Property Level Authorization.

Enforces OWASP Top 10:2025 compliance on code touching security-relevant domains, using cached cheat sheets and verifying fixes against OSV.dev.

Builds repeatable API security test suites in Postman covering OWASP API Security Top 10 vulnerabilities, with automated authentication, multi-role testing, and CI/CD integration via Newman.

Guides backend development across API design, authentication, security, performance, architecture, and testing, with decision guides and defaults for production-ready systems.

Web application security scanner with proxy and active/passive scanning

Configure ModSecurity WAF with OWASP Core Rule Set for web application logging, tune rules to reduce false positives, and analyze audit logs for attack detection.

Enforce API input/output contracts using OpenAPI specifications and JSON Schema to prevent injection, mass assignment, and data leakage attacks.

Run MISP, curate threat feeds, and auto-generate detections for Wazuh, Sigma, and Suricata.

Detect and test for OWASP API3:2023 Broken Object Property Level Authorization vulnerabilities including excessive data exposure and mass assignment attacks.

Guides backend development across API design, authentication, databases, performance, security, scalability, and testing, with quick decision guides and defaults for production-ready systems.

Runs OWASP ZAP security scans against web applications using Java or Docker, with setup guidance and links to upstream documentation.