Data

Tools

Indexes

Applications

Experiments

Awesome

An open API service indexing awesome lists of open source software.

Projects in Awesome Lists tagged with api-security

A curated list of projects in awesome lists tagged with api-security .

https://github.com/jassics/security-study-plan

Complete Practical Study Plan to become a successful cybersecurity engineer based on roles like Pentest, AppSec, Cloud Security, DevSecOps and so on...

api-security application-security appsec appsec-tutorials aws-security azure-security cybersecurity cybersecurity-education devsecops-university gcp-security infosec pentesting security-testing study-guide study-plan study-planner

Last synced: 27 Jul 2025

https://github.com/smodnix/31-days-of-API-Security-Tips

This challenge is Inon Shkedy's 31 days API Security Tips.

api-pentest api-security bug-bounty bugbounty bugbountytips infosec pentest security

Last synced: 02 May 2025

https://github.com/inonshk/31-days-of-API-Security-Tips

This challenge is Inon Shkedy's 31 days API Security Tips.

api-pentest api-security bug-bounty bugbounty bugbountytips infosec pentest security

Last synced: 14 Mar 2025

https://github.com/API-Security/APIKit

APIKit：Discovery, Scan and Audit APIs Toolkit All In One.

api-sec api-security apisec burp-extensions

Last synced: 10 May 2025

https://github.com/api-security/apikit

APIKit：Discovery, Scan and Audit APIs Toolkit All In One.

api-sec api-security apisec burp-extensions

Last synced: 15 May 2025

https://github.com/HolyBugx/HolyTips

A Collection of Notes, Checklists, Writeups on Bug Bounty Hunting and Web Application Security.

api api-security bugbounty bugbounty-writeups bugbountytips checklist pentest pentesting security web webapp websecurity writeups

Last synced: 11 Jul 2025

https://github.com/wallarm/gotestwaf

An open-source project in Golang to asess different API Security tools and WAF for detection logic and bypasses

api-security bugbounty graphql-security grpc-security owasp rest-security security security-testing security-tools waf web-application-firewall web-application-security

Last synced: 14 May 2025

https://github.com/akto-api-security/akto

Proactive, Open source API security → API discovery, API Security Posture, Testing in CI/CD, Test Library with 1000+ Tests, Add custom tests, Sensitive data exposure

api-discovery api-security api-security-posture api-security-testing api-testing authentication authorization devsecops devsecops-pipeline hacktoberfest hacktoberfest2023 idor owasp-top-10 security security-testing sensitive-data-exposure threat-detection

Last synced: 23 Jan 2026

https://github.com/blst-security/cherrybomb

Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.

api api-security best-practices blst business-logic cli cyber cybersecurity firecracker http open-source openapi openapi3 security security-tools web-sec-scanner web-security websecurity

Last synced: 10 Apr 2025

https://github.com/openappsec/openappsec

open-appsec is a machine learning security engine that preemptively and automatically prevents threats against Web Application & APIs. This repo include the main code and logic.

api-security application-security appsec devsecops kong kubernetes nginx nginx-proxy-manager owasp owasp-top-ten rate-limiting security-tools threat-prevention waf web-application-firewall

Last synced: 29 Dec 2025

https://github.com/safe3/uuwaf

An industry-leading free, high-performance, AI and semantic technology Web Application Firewall and API Security Gateway (WAAP) - UUSEC WAF.

api-gateway api-security application-security data-mask ddos hips modsecurity nginx owasp rasp security sql-injection uusec uusec-waf uuwaf waap waf web-application-firewall web-security-gateway xss

Last synced: 18 Jun 2025

https://github.com/dsopas/MindAPI

Organize your API security assessment by using MindAPI. It's free and open for community collaboration.

api-security hacking methodology mindapi mindmap

Last synced: 11 Jul 2025

https://github.com/owasp/offat

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.

api-hacking api-rest api-security api-security-testing offat owasp

Last synced: 14 Jan 2026

https://github.com/OWASP/OFFAT

The OWASP OFFAT tool autonomously assesses your API for prevalent vulnerabilities, though full compatibility with OAS v3 is pending. The project remains a work in progress, continuously evolving towards completion.

api-hacking api-rest api-security api-security-testing offat owasp

Last synced: 10 May 2025

https://github.com/apiclarity/apiclarity

An API security tool to capture and analyze API traffic, test API endpoints, reconstruct Open API specification, and identify API security risks. 

api-security envoy istio k8s kubernetes microservice microservices openapi openapi-spec openapi-specification service-mesh shadow-api swagger wasm zombie-api

Last synced: 02 May 2025

https://github.com/openclarity/apiclarity

An API security tool to capture and analyze API traffic, test API endpoints, reconstruct Open API specification, and identify API security risks. 

api-security envoy istio k8s kubernetes microservice microservices openapi openapi-spec openapi-specification service-mesh shadow-api swagger wasm zombie-api

Last synced: 23 Oct 2025

https://github.com/adhocore/php-jwt

Ultra lightweight, dependency free and standalone JSON web token (JWT) library for PHP5.6 to PHP8.4+. This library makes JWT a cheese. It is a minimal JWT integration for PHP.

adhocore api-auth api-security json-web-signature json-web-token json-web-token-php jwt jwt-auth jwt-authentication oauth2 php php-jwt php7 php8

Last synced: 14 May 2025

https://github.com/piomin/sample-spring-oauth2-microservices

some examples that show basic and more advanced implementations of oauth2 authorization mechanism in spring-cloud microservices environment

api-security authorization jwt microservices-security oauth oauth2 spring-boot spring-cloud spring-security spring-security-oauth2 zuul

Last synced: 10 Jun 2025

https://github.com/escape-technologies/graphql-security-academy

🔒 A free, open-source platform dedicated to understand and secure GraphQL applications — all directly in your browser!

api-security certification community education graphql hacktoberfest hacktoberfest2023 learning security

Last synced: 27 Apr 2025

https://github.com/approov/appauth-oauth2-books-demo

A companion repo for the blog article: https://blog.approov.io/adding-oauth2-to-mobile-android-and-ios-clients-using-the-appauth-sdk

api-security approov approov-demo mobile mobile-app mobile-security

Last synced: 28 Apr 2025

https://github.com/jessety/simple-hmac-auth

Protocol specification and Node library designed to make building APIs that use HMAC signatures simple

api-security hmac-authentication nodejs request-signatures request-signing simple-hmac-auth

Last synced: 07 May 2025

https://github.com/paulveillard/cybersecurity-api-security-checklist

An ongoing collection of awesome software, API libraries, checlists, best guidelines and resources and most important security countermeasures when designing, testing, and releasing your API.

api-authentication api-authorizarion api-automation api-blueprint api-call api-client api-communication api-consumer api-design api-development-platform api-documentation api-documentation-tool api-endpoints api-generator api-security api-server secure-api

Last synced: 06 Jan 2026

https://github.com/wallarm/product-documentation

Wallarm Product Documentation

api-security docs waap waf wallarm

Last synced: 10 Jun 2025

https://github.com/codevate/public-api-blog-post-example

A companion project for our blog post describing how to secure public APIs client-side.

api-security oauth2 oauth2-server php public-api symfony-api symfony-application symfony2

Last synced: 10 Apr 2025

https://github.com/brahmlower/prefixed-api-key

A Rust module for generating Prefixed API Keys

api-security prefixed-api-key rust

Last synced: 14 Apr 2025

https://github.com/plumsydev/neptune-waf.app

Neptune is a Web Application Firewall that you can use to protect your domains against common attacks (XSS, SSRF, SQLI, Path Traversal) and many others, it also can be used to hide your web server backend IP and protect against most DDoS attacks, come visit us !

api api-security application ddos firewall http-proxy letsencrypt neptune neptunewaf owasp security tcp-proxy waap waf web web-application-firewall xss

Last synced: 13 Jan 2026

https://github.com/artioml/f5-app-sec

:sunglasses: Succeeding with application security

anti-bot api-security app-security bados f5-asm f5-awaf l7-ddos owasp waf

Last synced: 09 Oct 2025

https://github.com/elliotsecops/api-security-scanner

The API Security Scanner is a powerful tool designed to help developers and security professionals assess the security posture of their APIs. // API Security Scanner es una potente herramienta diseñada para ayudar a los desarrolladores y profesionales de la seguridad a evaluar el nivel de seguridad de sus APIs.

api-security cybersecurity cybersecurity-tools ethical-hacking pentesting security-audit

Last synced: 17 Sep 2025

https://github.com/abunuwas/api-auth-workshop

Code for the Workshop Securing APIs with OAuth in Python

api-security authorization fastapi json-web-token jwt oauth2

Last synced: 05 Jul 2025

https://github.com/swap76/enigma

Javascript GraphQL and REST API Encryption API

api-security apollo-graphql cryptojs https rest-api

Last synced: 31 Aug 2025

https://github.com/psnappz/shadowguard

Fast & Reliable API Security Engine

api-security firewall security

Last synced: 15 Apr 2025

https://github.com/approov/quickstart-elixir-phoenix-absinthe-graphql-token-check

Approov integration example quickstarts for the Elixir Phoenix framework with the Absinthe library for GraphQL

api api-security approov approov-backend approov-bakend-quickstart approov-quickstart elixir elixir-phoenix

Last synced: 22 Aug 2025

https://github.com/approov/quickstart-php-token-check

Quickstart Approov integration example for PHP without depending on a framework.

api api-security approov approov-backend approov-backend-quicksart approov-integration approov-quickstart backend php security

Last synced: 18 Jul 2025

https://github.com/approov/quickstart-ruby-token-check

Quickstart Approov integration example for Ruby without depending on a framework.

api api-security approov approov-backend approov-backend-quicksart approov-integration approov-quickstart security

Last synced: 27 Jun 2025

https://github.com/jessety/simple-hmac-auth-objc

Objective-C iOS framework for interfacing with APIs that implement hmac signatures

api-security hmac-authentication ios objective-c request-signatures request-signing simple-hmac-auth

Last synced: 23 Feb 2025

https://github.com/mikaelvesavuori/mikrosign

Lightweight HMAC request signing with zero dependencies.

api-security hmac signing

Last synced: 17 Jun 2025

https://github.com/dexcompiler/request-signatures

Secure API authentication mechanism using Request Signatures

api-key-management api-keys api-security authentication middleware

Last synced: 15 Aug 2025

https://github.com/escape-technologies/escape-rules

A community-driven list of custom Escape rules. Test your API security with rules that automatically adapt for you.

api-security api-security-testing escape-custom-rules-templates escape-rules security vulnerability-detection

Last synced: 26 Feb 2025

https://github.com/approov/appauth-oauth2-approov

Strengthens OAuth2 authorization by using mobile app attestation

api-security approov approov-mobile-quickstart mobile mobile-security

Last synced: 28 Apr 2025

https://github.com/jessety/simple-hmac-auth-koa

Koa middleware for creating APIs that implement hmac signatures

api-security hmac-authentication koa koa-middleware request-signatures request-signing simple-hmac-auth

Last synced: 08 Aug 2025

https://github.com/nsubhadipta/api-guardian-package

The ultimate VIP bouncer for your API. Only the right user agents and proper requests get in. Everyone else gets a 403.

api-guardian-package api-security middleware nodejs npm-package

Last synced: 13 Aug 2025

https://github.com/hackfutsec/subghost

SubGhost is a powerful subdomain discovery tool. It helps you discover hidden or less visible subdomains for a given domain using public API services. The tool is designed to be simple to use while offering great flexibility, such as the ability to choose the output format for results.

api-security cloud-security collaboration-and-data-sharing credential-and-secret-management cybersecurity-automation dns-amplification-attacks dns-analysis exploitation-and-pentesting internet-infrastructure-analysis machine-learning-and-artificial-intelligence passive-reconnaissance phishing-and-attack-reconnaissance privacy-and-anonymity python security-monitoring-and-incident-response subdomain-reconnaissance web-scraping-and-data-extraction

Last synced: 15 Mar 2025

https://github.com/ind4skylivey/s1bpassport-guard

Advanced OAuth2 token monitoring, threat detection & forensics for Laravel Passport. Track tokens, detect brute-force attacks, analyze client activity from CLI.

analitics api-security audit authentication cli cybersecurity devops forensics laravel laravel-package laravel-passport monitoring outh2 php red-team security symfony-console threat-detection token-management

Last synced: 13 Jan 2026

https://github.com/youssefwaelmohamedlotfy/duendesecureaspnet

Duende IdentityServer Demo of Securing APIs.

api-security dotnet6 duende-identityserver

Last synced: 24 Feb 2025

https://github.com/salmanfxrsi/causebridge-backend

Backend for the CauseBridge platform, built with Node.js and Express. It handles user authentication, CRUD operations for volunteer posts, and MongoDB data storage. Uses JWT for secure routes and environment variables for sensitive data management. Provides a RESTful API with CORS support.

api-development api-security backend cors crud-operations environment-variables express firebase jwt-authentication mongodb mongodb-atlas node-api nodejs rest-api user-authentication volunteer-management

Last synced: 30 Dec 2025

https://github.com/deepraj1729/devsecops

All in One repo about my journey in DevSecOps

api-security cloud-security devops gcp security web-security

Last synced: 28 Feb 2025

https://github.com/dhouib-mohamed/quoxy

Quoxy is an API authenticator proxy using Go and SQL, featuring secure token management via Cron jobs and a reverse proxy for authenticated requests.

api-gateway api-limiter api-security go proxy sql subscription token-management

Last synced: 20 Jul 2025

https://github.com/jessety/simple-hmac-auth-swift

Swift framework for interfacing with APIs that implement HMAC signatures

api-security hmac-authentication ios request-signatures request-signing simple-hmac-auth swift

Last synced: 13 Jun 2025

https://github.com/jessety/simple-hmac-auth-php

PHP library for interfacing with APIs that implement hmac signatures

api-security hmac-authentication php request-signatures request-signing simple-hmac-auth

Last synced: 23 Feb 2025

https://github.com/achrefdevtn/jwt-auth-starter

A Node.js and Express application showcasing JWT authentication with MySQL. Includes secure user registration, login, token-based protection for routes, and centralized error handling with Winston. Perfect for learning and implementing JWT in a real-world setting.

api-security authentication expressjs jwt mysql nodejs

Last synced: 30 Dec 2025

https://github.com/nanaelie/http-headers-collection

EN: A simple and practical collection of HTTP headers with recommended values, effects, and related security risks. FR : Une collection simple et pratique d’en-têtes HTTP avec leurs valeurs recommandées, effets et risques de sécurité associés.

api-security best-practices cheatsheet collection devsecops headers headers-collection http http-headers infose markdown open-source security security-headers web web-dev web-security

Last synced: 19 Jun 2025

https://github.com/king04aman/pdf-extractor-api

PDF Extractor API is a FastAPI project for extracting information from PDFs. It includes user authentication, PDF uploading, and text extraction. The API supports secure PDF uploads, keyword-based extraction, and rate limiting.

api-security docker-compose doker fastapi invoice-management invoice-pdf jwt-auth jwt-authentication jwt-token pdf-processing pdf-processor python python3 rate-limiting sap

Last synced: 18 Jan 2026

https://github.com/copyleftdev/h4x0r_b41t

is a mischievously designed, high-tech honeypot API built to lure, confuse, and troll cyber-intruders. With its blend of structured, color-coded logging, randomized responses, and playful headers, H4X0R_B41T keeps hackers guessing while providing you with valuable insights.

api-security cyber-defense cybersecurity hacker-deterrent honeypot infosec prank-api threat-intelligence

Last synced: 14 Oct 2025

https://github.com/abhishektiwari/axioms-express-js

Axioms Javascript client for Express. Secure your Express APIs using Axioms authentication and authorization.

access-token api api-security authentication authorization axioms express-js oauth2 openid openid-connect

Last synced: 14 Oct 2025

https://github.com/lunzai/gobrute

A RESTful API brute-forcing tool in Go for ethical hacking practice. **Gobrute** is built for testing login passwords with multithreading, progress tracking, and customizable payloads, ideal for controlled environments like OWASP Juice Shop.

api-security api-security-testing brute-force cybersecurity ethical-hacking ethical-hacking-tools go golang infosec owasp owasp-juice-shop owasp-top-10 password-cracking password-testing pentesting rest-api security-testing security-tools

Last synced: 03 Apr 2025

https://github.com/mreshboboyev/api-rate-limiter

A robust and scalable API Rate Limiter implementation in .NET Core, supporting 4 algorithms (Fixed Window, Sliding Window, Token Bucket, Concurrency) with IP-based rate limiting. Built using Clean Architecture and integrated with Redis for distributed environments.

api-security clean-architecture concurrency fixed-window ip-based-rate-limiting middleware rate-limiting redis security sliding-window throttling token-bucket

Last synced: 05 Apr 2025

https://github.com/abdelrahman-hassany/django-rate-limit-api

A secure Django REST API for sending emails, protected against brute force with Django Ratelimit and custom Redis-based rate limiting.

api-security backend django django-rest-framework rate-limiting redis web-development

Last synced: 02 Jul 2025

https://github.com/rickcontreras/telconova-supportsuite-auth-service

Telconova SupportSuite Auth Service is a Java-based microservice for secure user authentication. It supports JWT and role-based access control, offering a scalable and high-performance solution for access management.

api-security authentication-and-authorization authentication-service codespaces devcontainer docker java jwt microservice spring-boot

Last synced: 13 Oct 2025

https://github.com/keshavabanda/micro-services

Exploring microservices in the real world - This is a sample project I was exploring recently with dockering..

api-security authentication express javascript jwt mongodb mongoose nodejs rest-api

Last synced: 30 Dec 2025

https://github.com/namuan/api-tools-web

Source code for https://www.webapis.xyz/ developed using Hugo and a custom theme

api api-development api-framework api-mocking api-monitoring api-security api-standards api-testing api-tools hugo-site static-website

Last synced: 28 Mar 2025

https://github.com/ahmetcakr/narchitecture-rentacar-api

This project is a monolith project which uses advanced techniques.

api-security elasticsearch in-memory-database logging role-based-authorization webapi

Last synced: 22 Feb 2025

https://github.com/aronno1920/netcore-webapi-owasp-api-security

Welcome to "OWASP API Security Top Ten and Beyond!" The objective of this course is to help students become API security professionals and to be able to identify and reduce API-related security risks. OWASP API Security Top Ten and Beyond! is meant to help improve the skills of bug bounty hunters, developers, penetration testers, organizational

api-security netcore owasp owasp-top-10 security webapi

Last synced: 20 Aug 2025

https://github.com/samanshafagh/python-fastapi-auth-microservice

Production-ready authentication microservice built with FastAPI. Features JWT auth, Google & GitHub OAuth2, role-based access control, PostgreSQL, Dockerized deployment, Alembic migrations, and 95%+ test coverage. Designed for secure, scalable backend systems.

api-security backend docker fastapi jwt microservice oauth2 postgresql pytest python sqlalchemy

Last synced: 31 Dec 2025