Question 1

What does this tool check?

Accepted Answer

It inspects the submitted OpenAPI document and renders backend findings, coverage, warnings, and recommendations in a readable report.

Question 2

Does this prove a vulnerability?

Accepted Answer

No. Treat findings as review signals that should be confirmed against runtime configuration and threat model.

Question 3

Does global security count as authentication coverage?

Accepted Answer

Yes, OpenAPI operations can inherit root-level security unless an operation explicitly overrides it.

Question 4

What does security: [] mean?

Accepted Answer

An empty operation-level security array usually means the operation is intentionally public and should be reviewed carefully.