The safeguards map / 2.1 Tester-run
OWASP API Security Testing Framework
Drafted with AI
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made
A Java command-line scanner that tests a running API for the OWASP API Security Top 10 weaknesses and writes reports, with documented CI pipeline use.
Where it sits
2.1 Tester-run (primary): Sends test cases for the OWASP API Security Top 10 to a running API from a command line and writes a report of findings.
A comprehensive automated testing framework for detecting API security vulnerabilities
captured
Run your first scan (copy-paste ready)
captured
2.2 CI-integrated: Runs in a pull request pipeline and returns an exit code that fails the build when findings are detected.
GitHub Actions — Scan on Every Pull Request
captured
Fail build on HIGH or CRITICAL findings
captured
Facts
- Concern
- security
- Names the law
- no
- Subject
- software
- Used by
- those who make it
- Runs
- by handin CI
- Tests
- the application or API
Handoffs
produces Findings: SARIF
Collector's note
The program, its releases and its documentation live in the project's page repository. The README quick start is a hand-run scan, so tester-run is primary; the pull request pipeline recipe is documented separately, so it is the secondary placement.
Every quote is verbatim from a stored capture of the page linked under it. Placement is our reading of the product's own documentation; no publisher has reviewed or endorsed it. Rows CC BY 4.0. Names, marks and logos belong to their owners; logos identify each product and are not part of the dataset.