API Security Analysis Tools
Free API security tools: detect secrets in payloads, analyze JWT tokens, scan for PII, audit CORS headers, and find debug flag exposure. By Graph Tools.
- Secret Exposure Sentinel — Scan JSON/XML payloads for credentials, API keys, JWTs, OAuth tokens, and private key blocks using pattern and entropy analysis
- Data Privacy Inspector — Detect PII patterns including email, phone, IBAN, PAN, and national ID numbers in API payloads and response samples
- JWT Integrity Analyzer — Decode JWT tokens and flag risky configs: alg=none, missing iss/aud, excessive expiry, and future nbf
- Error Leak Radar — Scan error payloads and headers for stack traces, SQL errors, debug dumps, internal hostnames, and framework signatures
- Header Hardening Advisor — Evaluate HTTP request/response headers for risky CORS settings, missing cache controls, and absent security headers
- Sensitive Field Exposure Analyzer — Flag suspicious field names like password, secret, apiKey, and token in API responses and schemas when they appear in outbound data
- Response Surface Analyzer — Compute API response size, field count, nesting depth, and repeated patterns to highlight bloat and excessive data exposure risks
- Debug Flag Exposure Detector — Find debug flags and verbose diagnostic fields like debug=true and traceId dumps in API payloads that should not appear in production
- Token Lifetime Risk Evaluator — Compute JWT token lifetime from exp/iat values, flag overly long sessions, and review refresh token patterns
- Spec Auth Coverage Quickcheck — Show which OpenAPI operations are effectively public due to missing or empty security requirements
- CSP Parser & Analyzer — Parse Content-Security-Policy headers and surface risky directives like unsafe-inline with hardened template suggestions
- HTTP Security Header Analyzer — Analyze raw HTTP response headers and surface missing or weak HSTS, CSP, X-Frame-Options, and other browser security protections