SecureAPI Scanner

Problem

Modern applications expose dozens of API endpoints, and manually checking each one for common weakness patterns — broken auth, injection, IDOR, SSRF, CORS misconfiguration — doesn't scale, and findings rarely get tracked between test runs.

Approach

Built a FastAPI backend that accepts a single endpoint, an OpenAPI/Swagger spec, an uploaded spec file, or a live website for endpoint discovery, runs the target through a bank of API-focused scanners, and persists every scan and finding to SQLite so results are queryable and comparable over time — fronted by a lightweight dashboard for triggering scans and drilling into results.

Stack

• Python
• FastAPI
• Uvicorn
• SQLAlchemy (async)
• SQLite / aiosqlite
• httpx
• BeautifulSoup
• PyJWT

Outcome

Turns ad hoc API testing into a repeatable workflow with a persistent findings history, making it faster to prioritize high-impact issues like broken authorization and injection flaws before they reach production.