OpenAPI Security Analyzer
Review an API specification for the things that make it attackable.
Runs entirely in your browser — nothing you paste is sent to our servers.
What this tool does
Unauthenticated writes
Operations that modify data with no security requirement, including ones that explicitly opt out of the global one.
Weak auth patterns
HTTP Basic, API keys in query strings, the OAuth implicit flow — each with why it matters rather than just a label.
Secrets in URLs
Passwords and tokens declared as query or path parameters, where every proxy and log file records them.
Never uploaded
A specification maps your entire surface area. It is parsed in this tab and no request is made.
Frequently asked questions
Why review the specification rather than the running API?
Because the specification is a description of the entire attack surface written by the people who built it — every operation, parameter and authentication requirement, in machine-readable form. Testing a live API tells you about the endpoints you thought to test. The spec tells you about the ones you forgot.
What does it look for?
Operations that modify data with no authentication, endpoints that opt out of the global security requirement, secrets and personal data carried in query strings, HTTP Basic and API keys in URLs, the OAuth implicit flow, plain-HTTP servers, undocumented rate limiting, and deprecated operations still published.
Does it support Swagger 2.0 as well as OpenAPI 3?
Both. They express the same ideas with different vocabularies — securityDefinitions against components.securitySchemes, host plus basePath against servers — so reading one as the other silently finds nothing. Each is parsed on its own terms.
Why does an empty security array matter so much?
Because "security": [] is not the same as omitting the field. Omitting it means the operation inherits the global requirement; an empty array explicitly overrides it and makes the operation public. It is the single easiest way to leave an endpoint open while the spec looks like it is protected.
Is a public endpoint always a finding?
No, and it is reported as something to confirm rather than something to fix. Health checks, version endpoints and genuinely open data are meant to be public. What the tool can tell you is which operations are public; whether each should be is a question only you can answer.
Does it accept YAML?
Not directly. A YAML parser is a sizeable dependency, and carrying it would mean this could not run entirely in your browser. Every OpenAPI tool can export JSON, and an internal specification is exactly the sort of file that should not be uploaded to a remote service.
Is my specification sent anywhere?
No. It is parsed and analysed in this tab, and the page makes no request. That is deliberate — an API specification is a complete map of your surface area.
Monitor it, don't just check it
One-off checks catch what is broken today. CertNotify watches your certificates, domains, DNS and code continuously and tells you before something breaks.