Alternatives
Products that do what Devunus - Open API Audit does
Free security analysis for API specifications
- 1OD
Effortlessly discover API behaviour with a Chrome extension that automatically generates OpenAPI specifications in real time for any app or website.
2023 · github.com
- 2WM
Hey, I'm Martyn and I recently joined Zuplo. OpenAPI is a huge part of what we do, but getting a document up to scratch out of the gate, especially if you're not super well versed in the actual specification and what you should use and when. So we built a suite of tools to help with this called Rate My OpenAPI. It will score your OpenAPI document out of 100, as well as giving you individual scores in 4 key areas; completeness, SDK generation, security and documentation. Along with the score, you also get details of what the issues, or errors are, as well as guidance on what they actually…
2024 · github.com
- 3
- 4
- 5OS
tl;dr we released openapi.security, an online tool that performs a dozen of security tests on any given openapi/swagger-based API, with no signup or email required. You can try it here: https://openapi.security My team at Escape (YC W23) is mainly focused on securing GraphQL APIs. For this, we developed a new approach called Feedback driven API Exploration. Basically, we infer the right security tests cases to run using the specification and a carefully crafted in house graph traversal algorithm. (It's a bit long to describe here but we published a more in depth explanation of…
2023 · openapi.security
- 6
- 7
- 8
- 9AG
Hey HN! We've developed OpenAPI AutoSpec, a tool for automatically generating OpenAPI specifications from localhost network traffic. It’s designed to simplify the creation of API documentation by just using your website or service, especially useful when you're pressed for time. Documenting endpoints one by one sucks. This project originated from us needing it at our past jobs when building 3rd-party integrations. It acts as a local server proxy that listens to your application’s HTTP traffic and automatically translates this into OpenAPI 3.0 specs, documenting endpoints, requests, and…
2024 · github.com
- 10
- 11
- 12
- 13AD
tl;dr we at Escape (YC W23), we scanned 5651+ public APIs on the internet with our in house feedback driven API exploration tech, and ranked them using security, performance, reliability, and design criteria. The results are public on https://apirank.dev. You can request that we index your own API to the list for free and see how it compares to others. Why we did that? During a YC meetup I spoke with a fellow founder that told me how hard it was to pick the right external APIs to use within your own projects. I realized that most of what we build relies on public APIs from external…
2023 · apirank.dev
- 14
- 15
A curated list of free OSS developer-first security tools
2022
- 16
- 17
- 18OS
2022 · github.com
- 19NW
2021 · github.com
- 20OF
2021 · github.com
- 21RB
2022 · github.com
- 22KD
I built this after seeing multiple teams accidentally ship API keys in their frontend code. The problem: Modern web development moves fast. You're vibe-coding, shipping features, and suddenly your AWS keys are sitting in a tag visible to anyone who opens DevTools. I've personally witnessed this happen to at least 3-4 production apps in the past year alone. KeyLeak Detector runs through your site (headless browser + network interception) and checks for 50+ types of leaked secrets: AWS/Google keys, Stripe tokens, database connection strings, LLM API keys (OpenAI, Claude, etc.), JWT…
Nov 2025 · github.com
- 23OS
We built an open-source tool that scans your codebase and generates OpenAPI docs in minutes. Right now it supports Rails, Go, Python, and NodeJS frameworks, and we will keep adding more. It picks up routes, params, request bodies, and models directly from the code and outputs a clean OpenAPI spec you can drop into your workflow.
Nov 2025 · github.com
- 24
hey guys, wanted to show one of my side projects i just made public. the idea is basically another osint tool for pentesters and bug bounty hunters. it watches certificate transparency logs and checks newly-seen domains for exposed stuff like .env files, open .git dirs, config files, db dumps and so on, and puts whatever it finds into a searchable db. you just search a domain (or part of one) and see what's exposed. it's read-only and free. one thing i've been thinking about adding is a way to register for certain keywords and get notified when something new shows up for that search. would…
Jul 2026 · search.cerast-intelligence.com
Ranked by how close each launch is in meaning, then by votes. Refine with a description →