What it checks
API Security reviews API documentation exposure, HTTP method exposure, versioned endpoint discovery, endpoint auth indicators, excessive CORS configuration, sensitive response patterns, rate-limit readiness, JWT weaknesses, shadow API discovery, WebSocket security, and missing Subresource Integrity (SRI).
With consent, it also queries GraphQL introspection to map the schema, and checks for GraphQL DoS readiness against batching, alias, and depth-based abuse.
Dependency CVE matching
Paste a package-lock.json, requirements.txt, pom.xml, or CycloneDX/SPDX SBOM and BreakMesh looks up known CVEs for each dependency via the public OSV.dev database — no live probing of the target required for this check.
A headless-browser drive-by-download check is also available with consent, rendering the homepage to detect unsolicited file downloads or malicious redirect chains without submitting forms or clicking links.
All 16 checks in this package
Included from the Team plan and up.
- API Documentation Exposure
- HTTP Method Exposure
- Versioned Endpoint Discovery
- Endpoint Auth Indicators
- Excessive API CORS Checks
- Sensitive Response Pattern Detection
- API Rate-Limit Readiness
- API Third-Party Dependency Inventory
- JWT Weakness Detection
- GraphQL Introspection Exposure
- GraphQL DoS Readiness (Batching / Alias / Depth)
- Shadow API Discovery
- WebSocket Security Check
- Subresource Integrity (SRI) Missing
- Dependency CVE Matching (SBOM)
- Drive-by Download / Malicious Redirect Chain