Skip to content
SPECIFICTION
Get listed

VulnAPI

cerberauth.com

Free plan WindowsmacOSLinuxSelf-hosted
Visit cerberauth.com
Spec score 7.3 #22 of 27 in API Security Testing Software

What it is

VulnAPI is a free, open-source dynamic application security testing tool for scanning APIs for vulnerabilities and security risks. It can scan from a curl-like CLI, OpenAPI contracts, or a GraphQL endpoint. The product page says it detects all ten OWASP API Security Top 10 categories out of the box; listed test areas include API discovery, authentication, authorization, input validation, and business logic. Reports identify risk level, vulnerability, description, and the operation where a finding occurred. Findings also include the triggering request and remediation steps in plain language. Teams can tailor assessments to their needs and run scans in GitHub Actions, GitLab CI, or Jenkins. Pre-built binaries and installation instructions are provided for Linux, Windows, and macOS, with Docker also available; deployment is self-hosted. The scanner collects anonymous usage data about scan counts and detected vulnerability counts and severity, but a command-line flag lets users opt out. Proxy settings can be supplied through HTTP_PROXY or HTTPS_PROXY environment variables or a --proxy argument. The tool is released under the MIT License and is free to use, modify, and distribute for educational and testing purposes.

Spec sheet

What it does
VulnAPI is an open source dynamic application security testing tool that scans APIs for vulnerabilities and security risks.Read 3 Oct 2026 · cerberauth.com
CI/CD integrations
The maker lists GitHub Actions, GitLab CI, and Jenkins as supported CI/CD pipeline integrations.Read 3 Oct 2026 · cerberauth.com
Custom scans
The product page says teams can tailor security assessments to their requirements and environments.Read 3 Oct 2026 · cerberauth.com
Installation
Pre-built binaries and installation instructions are provided for Linux, Windows, and macOS, with Docker also available.Read 3 Oct 2026 · cerberauth.com
OWASP coverage
The product page says VulnAPI detects all ten OWASP API Security Top 10 categories out of the box.Read 3 Oct 2026 · cerberauth.com
Proxy support
The scanner supports proxy configuration through HTTP_PROXY or HTTPS_PROXY environment variables or a --proxy argument.Read 3 Oct 2026 · github.com
Remediation guidance
The product page says findings include a plain-English description, the triggering request, and concrete remediation steps.Read 3 Oct 2026 · cerberauth.com
Reports
Scan reports include the risk level, vulnerability, description, and operation where the finding was detected.Read 3 Oct 2026 · cerberauth.com
Scan methods
It scans APIs through a curl-like CLI, OpenAPI contracts, or a GraphQL endpoint.Read 3 Oct 2026 · cerberauth.com
Support channel
The repository invites users to request additional vulnerability checks or best practices by opening an issue or submitting a pull request.Read 3 Oct 2026 · github.com
Target audience
The product page describes VulnAPI as built for security-minded teams.Read 3 Oct 2026 · cerberauth.com
Telemetry
The scanner collects anonymous usage data about scan counts and detected vulnerability counts and severity; users can opt out with a command-line flag.Read 3 Oct 2026 · github.com

Plans and prices

Open source (MIT License) Free Free to use, modify, and distribute for educational and testing purposes Read 3 Oct 2026 · github.com

Every VulnAPI plan and price →

Strong points and limits

Strong points

  • Detects all ten OWASP API Security Top 10 categories
  • Reports findings with triggering requests and remediation steps
  • Integrates with GitHub Actions, GitLab CI, and Jenkins
  • Pre-built binaries for Linux, Windows, and macOS
  • Anonymous usage collection can be disabled

Limits

  • Deployment is self-hosted
  • Anonymous scan and finding statistics are collected by default

Who it suits

It suits security-minded teams scanning APIs in self-hosted environments or CI/CD pipelines. Its command-line and contract-based scan options cover REST, OpenAPI, GraphQL, and curl-like requests.

Verdict

VulnAPI combines API security scanning with detailed finding reports and CI/CD integrations. Users should account for self-hosting and decide whether to opt out of anonymous usage collection.

Where Specifiction places it

Alternatives to VulnAPIAll alternatives →