API Security Scan

Find the security holes in your API design before they ship. Read-only: it flags issues with file:line, it doesn't change your code.

Prerequisites

• None. Pure Claude Code — reads your OpenAPI/Swagger spec or route/handler code directly, no MCP required.

Trigger

• "Security review my API / OpenAPI spec"
• "Check my endpoints for missing auth"
• "API security scan"

Workflow

1. Locate the API surface: an OpenAPI/Swagger file if present, otherwise the route definitions and handlers.
2. Review each endpoint against the checks below; report path or file:line, severity, and the fix.

What to flag

3. Output a severity-ranked report:

## API Security Scan

**2 high, 1 medium**

### HIGH
- GET /users/{id} — no ownership check; any authenticated user can read any
  record (BOLA). Enforce that the caller owns or may access {id}.
- POST /login — no rate limiting; vulnerable to credential brute-force. Add
  per-IP/per-account throttling and lockout.

### MEDIUM
- GET /search — returns full stack traces on error. Return a generic message;
  log details server-side.

Diagnostic only. Want API auth and BOLA scanning on every PR? See QualityMax — qualitymax.io