[{"data":1,"prerenderedAt":223},["ShallowReactive",2],{"project-34794204":3},{"id":4,"name":5,"line":6,"line_source":7,"title":8,"url":9,"domain":10,"maker":11,"posted_at":12,"year":13,"points":14,"comments":15,"rank_in_year":16,"shown_in_year":17,"top":18,"tier":19,"category":20,"subcategory":21,"format":22,"keywords":23,"reception":28,"sentiment":29,"stance_mix":30,"scored_comments":35,"aspects":36,"strip":40,"post_text":42,"what":43,"said":68,"maker_in_thread":133,"shape":135,"grid":138,"attempts":185,"same_week":186,"maker_shows":31,"maker_hidden":215,"reader_version":216,"card":217},"34794204","Openapi.security","A fast security checker for REST-based API","title","Show HN: Openapi.security, a fast security checker for REST-based API","https:\u002F\u002Fopenapi.security","openapi.security","glimow",1676401110,2023,15,18,1931,3109,63,"shown","security_privacy","api security scanner","web_app",[24,25,26,27],"api security testing","openapi scanner","swagger security","rest api security","curious",0.154,{"positive":31,"neutral":32,"mixed":33,"critical":34},3,9,0,1,13,{"execution":37,"docs":38,"performance":39},{"positive":33,"critical":34},{"positive":33,"critical":33},{"positive":34,"critical":33},[34,31,41,31,31,31,31,33,41,33,31,33,31,41,31,33,33,31],5,"tl;dr we released openapi.security, an online tool that performs a dozen of security tests on any given openapi\u002Fswagger-based API, with no signup or email required. You can try it here: https:\u002F\u002Fopenapi.security\n\nMy team at Escape (YC W23) is mainly focused on securing GraphQL APIs. For this, we developed a new approach called Feedback driven API Exploration.\n\nBasically, we infer the right security tests cases to run using the specification and a carefully crafted in house graph traversal algorithm. (It's a bit long to describe here but we published a more in depth explanation of how this algor",{"problem":44,"audience":50,"pricing":55,"motivation":59,"time_to_build":63,"stack":64,"openness":65,"stage":66,"team_size":67},{"value":45,"source":46,"evidence":47},"Finds security issues in REST APIs described by OpenAPI or Swagger specs","maker",[48],{"id":49},"post",{"value":51,"source":52,"evidence":53},"Developers who build or run REST APIs","inferred",[54],{"id":49},{"value":56,"source":46,"evidence":57},"No signup or email required to use",[58],{"id":49},{"value":60,"source":46,"evidence":61},"Team tested whether their feedback-driven exploration approach from GraphQL security work applies to REST APIs",[62],{"id":49},null,[],"unknown","beta","company",{"praise":69,"objections":78,"requests":93,"questions":112,"alternatives":125},[70],{"value":71,"source":72,"evidence":73},"Handy and quick to use; found an unauthenticated route","commenter",[74],{"id":75,"by":76,"text":77},"34794246","sophieblo","Really handy this online scan tool! It detected an unauthenticated POST route on my API!",[79,86],{"value":80,"source":72,"evidence":81},"Failed with a 502 error on a large custom schema",[82],{"id":83,"by":84,"text":85},"34811721","helb","My schema breaks it somehow, the POST request to openapi.prod.scanner.cloud.escape.tech\u002Ffast returns a 502 after ~20s: https:\u002F\u002Fi.vgy.me\u002FD14u3k.png",{"value":87,"source":72,"evidence":88},"Cannot scan authenticated endpoints yet",[89],{"id":90,"by":91,"text":92},"34794269","steffthestunter","Seems like a nice tool! Just a quick question, I do run some authenticated endpoints and would like to have them scanned. How can I achieve that with this scanner ?",[94,101],{"value":95,"source":72,"evidence":96},"Support for authenticated APIs via headers",[97],{"id":98,"by":99,"text":100},"34794293","iCarossio","We plan to support authenticated APIs through headers soon. Stay tuned on our Discord https:\u002F\u002Fdiscord.escape.tech\u002F",{"value":102,"source":72,"evidence":103},"Ability to test local APIs",[104,108],{"id":105,"by":106,"text":107},"34794235","MintsInc","Looks nice, is there a way to test a local api ?",{"id":109,"by":110,"text":111},"34794229","Dribble4633","Can I test my dev API ?",[113,118],{"value":114,"source":72,"evidence":115},"How to scan local or dev APIs",[116,117],{"id":105,"by":106,"text":107},{"id":109,"by":110,"text":111},{"value":119,"source":72,"evidence":120},"How to enable unauthenticated route detection",[121],{"id":122,"by":123,"text":124},"34794267","spQKL","Awesome ! I tried and saw grey checks. How can I manage to activate unauthenticated route detection ?",[126],{"value":127,"source":72,"evidence":128},"graphql.security, the same team's GraphQL scanner",[129],{"id":130,"by":131,"text":132},"34794220","gauben","Hey there, Escape dev here! This project follows the steps of graphql.security, our fast and free graphql API scanner, check it out if you use graphql rather than swagger\u002Fopenapi",{"comments":33,"answered":33,"key":134},[],{"commenters":136,"max_depth":31,"maker_replies":33,"first_comment_mins":34,"lifespan_hours":137},11,47,[139,141,145,147,150,152,154,157,161,162,165,167,169,172,177,179,181,183],[83,33,34,140,84,33],"project\u002Fcritical\u002Fexecution",[142,33,31,143,144,33],"34822395","maker\u002Fneutral\u002Fexecution","nohehf",[130,34,41,146,131,33],"project\u002Fpositive\u002Fnone",[90,148,31,149,91,33],2,"project\u002Fneutral\u002Fnone",[98,148,31,151,99,33],"maker\u002Fneutral\u002Fnone",[153,31,31,151,99,33],"34794221",[122,155,31,156,123,33],4,"project\u002Fneutral\u002Fexecution",[158,155,33,159,160,33],"34794281","commenter\u002Fneutral\u002Fexecution","swan_escape",[75,41,41,146,76,33],[163,41,33,164,99,33],"34794261","commenter\u002Fneutral\u002Fnone",[105,166,31,149,106,33],6,[168,166,33,164,99,33],"34794247",[170,166,31,171,144,33],"34794253","maker\u002Fneutral\u002Fdocs",[173,174,41,175,176,33],"34794764",7,"project\u002Fpositive\u002Fperformance","Patescape",[109,178,31,149,110,33],8,[180,178,33,164,99,33],"34794239",[182,178,33,164,110,33],"34794263",[184,178,31,171,144,33],"34794242",[],[187,192,197,201,205,210],{"id":188,"name":189,"points":190,"category":191},"34729849","ScreenStab",497,"creative",{"id":193,"name":194,"points":195,"category":196},"34730520","boxxy",384,"dev_tools",{"id":198,"name":199,"points":200,"category":191},"34795155","Peel",353,{"id":202,"name":203,"points":204,"category":196},"34740529","Spaghettify",323,{"id":206,"name":207,"points":208,"category":209},"34780579","Paperlist",287,"learning_science",{"id":211,"name":212,"points":213,"category":214},"34770898","WAAS",267,"ai",false,"v2",{"id":218,"name":5,"line":6,"ai":215,"cat":20,"year":13,"points":14,"comments":15,"rec":28,"s":219,"top":18,"kw":220,"maker":11,"domain":10,"tier":19,"attempts":33,"strip":221,"url":9,"mix":222,"praise":71,"objection":80,"sub":21},34794204,0.15,[24,25,26,27],"135333305030353003",[31,32,33,34],1794036631220]