API security testing framework for REST, GraphQL, and gRPC that validates authorization logic using role-based testing and YAML-driven templates

Async API security scanner in Rust for CORS, CSP, GraphQL, JWT, OpenAPI, and active API posture checks.

Professional API security auditing tool that detects rate limiting vulnerabilities and misconfigurations in REST APIs

Built in the trenches—this repository captures real-world API security insights, attack techniques, and practical penetration testing workflows.

MCP server for autonomous API logic penetration testing. AI-driven detection of OWASP API Top 10 vulnerabilities (BOLA/IDOR) via multi-session authorization comparison. Supports Bearer, Basic, API Key, Cookie auth. Generates Markdown security audit reports with evidence.

Go-based CLI tool for testing REST APIs against BOLA/IDOR, JWT auth bypass, and mass assignment vulnerabilities — parses OpenAPI specs, tests cross-user authorization with body-diff confirmation, and outputs severity-scored JSON reports.

Secure healthcare API security demo in .NET 10 demonstrating JWT authentication, RBAC, audit logging, HIPAA-inspired access controls, secure middleware, and OWASP API Security concepts.

Defensive API security testing templates for Postman and Newman, with OWASP-aligned collections, safe payloads, CI/CD automation, and vulnerable local labs.

API-to-OT attack detection lab: crAPI + Conpot ICS honeypot + Grafana/Loki on Proxmox. Demonstrates BOLA, broken auth, and SSRF-to-OT pivot detection.

Intentionally vulnerable ASP.NET Core Web API for hands-on study of the OWASP API Security Top 10 2023.

Production-style API security observability lab with Kong Gateway, Flask, Prometheus, Loki, Grafana, active attack blocking, OWASP API validation, SOC dashboards, and compliance evidence.