api-scanner

在授权范围内找出泄露的 API 密钥，配对中转地址，扫描结束给出脱敏发现记录。

JSpider is a smart crawler for hidden endpoints. It crawls and extracts hidden API endpoints and URLs from JavaScript files and HTML source code - all directly in your browser.

APISCAN is a Swagger-driven API security tool for security specialists and auditors, focused on OWASP API Top 10 coverage and evidence-based reporting.

本地运行的浏览器安全助手，支持页面与 API 扫描、输入防泄漏、网页邮箱与 EML 钓鱼邮件识别、规则管理及多格式报告导出。（A local-first browser security assistant for page and API scanning, input leak prevention, phishing email analysis, rule management, and multi-format report export.）

Rust API scanner — spec, URL, fuzz, ghost mode, JS bundle analysis

Automated API security testing tool that scans REST and SOAP APIs for vulnerabilities using OpenAPI/Swagger specs and WSDL files. Deploys a full stack with OWASP ZAP, MariaDB, and MongoDB

一款针对 LLM 输入侧审查的精确逆向分析工具。自动定位 NewAPI、OneAPI 及任何实施基于字典规则进行 Prompt 过滤的 API 网关中的敏感关键词 | A precision reverse-engineering tool for LLM input censorship. Automatically pinpoints blocked keywords in NewAPI, OneAPI, and any API gateways enforcing dictionary-based prompt filtering.

A tool for detecting http request smuggling vulnerabilities.

Silent API security header scanner - active, passive and CORS detection

This is a API Security Scanner with panel

A comprehensive Swagger UI version detection and vulnerability scanner written in Go.

A Kali-friendly tool to scan for leaked or exposed API keys and identify which service they belong to, using over 1000 known patterns.

a versatile tool inspired by Postman that simplifies the process of testing and exploring APIs.

This is a Jenkins plugin for Helium Security vulnerability scanner. It provides a pipeline step to scan your application for vulnerabilities and fail the build if the number of vulnerabilities exceeds a certain threshold.

Advanced web crawler for recon, OSINT, API discovery, JS parsing & WAF-friendly crawling.

A professional Chrome DevTools extension for API traffic inspection and web pentesting.

A TypeScript tool that scans public GitHub repositories for exposed AWS credentials and Bedrock-related secrets, validates discovered key pairs against live AWS APIs, and generates structured JSON reports.

🔍 Standalone multi-language AI Model Explorer & Multi-Provider Playground for Windows (.EXE) — OpenAI, Gemini, Anthropic, OpenRouter, Groq, DeepSeek, Mistral, xAI & Ollama.

attackers love developers who commit credentials!!!

This GitHub Action allows you to automatically run security scans using Helium Security in your CI/CD workflow.