VulnAPI
VulnAPI: A self-hosted API security scanner covering discovery, contracts, GraphQL, and CI/CD checks. Ranked #18 of 27 in API Security Testing Software by our editors (7.4/10); pricing: Open source; best for open-source API security automation.
At a glance
- Editor score7.4 / 10
- PricingOpen source
- Best forOpen-source API security automation
- Paid fromFree
- Authorization testingYes
- Facts checked20 Sep 2026
Where it wins
- Scans OpenAPI, GraphQL, curl-like requests, paths, and exposed files
- Covers OWASP API Top 10, authentication, JWT, authorization, and business logic
- Supports CI/CD thresholds, proxy use, Docker, and JSON, YAML, or table reports
Where it doesn't
- Self-hosted deployment puts maintenance responsibility on the team
- Its integration set is narrower than broader security platforms
- Its focus is API security rather than wider application security
Our verdict on VulnAPI
VulnAPI is an open-source dynamic application security testing tool for developers and security teams that need to assess APIs before deployment or during continuous integration. It scans REST and GraphQL APIs through OpenAPI contracts, GraphQL endpoints, curl-like requests, well-known paths, and exposed files. Coverage includes discovery, input validation, authentication, JWT, authorization, business logic, and the OWASP API Top 10.
Its standout strength is the breadth of API-focused scanning in a self-hosted tool. VulnAPI can report affected operations, risk levels, vulnerability details, and remediation recommendations with triggered requests. Teams can use proxy support for APIs behind a proxy and choose JSON, YAML, or table reports. Severity-based CI/CD build thresholds add a practical control for preventing builds from passing when findings reach defined risk levels. Docker support and integrations with GitHub Actions, GitLab CI, and Jenkins support common development workflows.
VulnAPI fits organizations that want open-source API security automation and are prepared to manage deployment themselves. Its platform support covers Windows, macOS, Linux, and self-hosted environments, while its API formats include REST, OpenAPI, GraphQL, and curl-like requests. The product is less suited to teams seeking a managed service or a wider application-security platform beyond APIs. Choose it when API discovery, contract scanning, authentication checks, and CI/CD enforcement are the priority; consider an alternative when broader ecosystem coverage or managed operations matter more.
Your product? Our editors can test VulnAPI in depth and publish a review, labelled as paid · from $149/mo →
VulnAPI pricing
VulnAPI fact sheet
| Free plan | Not verified |
|---|---|
| Paid from | Free |
| API discovery | Yes |
| Authentication testing | Yes |
| Authorization testing | Yes |
| Input-validation testing | Yes |
| Business-logic testing | Yes |
| Deployment | Self-hosted |
| API formats | REST, OpenAPI, GraphQL, curl-like requests |
| Deployment | Self-hosted, Desktop |
| Platforms | Windows, macOS, Linux |
| Support | Docs, Community |
| Built for | Small business, Mid-market, Enterprise (editorial estimate) |
| Integrations | 4 integrations: GitHub Actions, GitLab CI, Jenkins, Docker |
| Pricing | Open source |
| Website | cerberauth.com |
| Facts checked | 20 Sep 2026 |
VulnAPI integrations
VulnAPI lists 4 integrations on its own site.
- GitHub Actions
- GitLab CI
- Jenkins
- Docker
Alternatives to VulnAPI
- Levo.aiA full-lifecycle API security platform spanning discovery, testing, and runtime monitoring.9.4
- PyntBroad API security coverage with flexible integrations and a free entry plan.9.3
- Akto API Security PlatformA broad API security platform with a free plan and hybrid deployment options.9.2
See all VulnAPI alternatives →
Used VulnAPI? Be the first to review it
The editor score above is our own research. What this page doesn't have yet is a reader's view — what you used VulnAPI for, what worked and what didn't. No stars are seeded and no review is paid for; an editor reads every one before it appears.
Write a reviewTwo minutes · verified accounts only · read by an editor before it appears
Featured on iTechGuides
VulnAPI is listed in our API Security Testing Software directory. Add the badge to your site — it links back to this page.
<a href="https://www.itechguides.com/products/vulnapi/"><img src="https://www.itechguides.com/best/badge/vulnapi.svg" alt="Featured on iTechGuides" width="230" height="46"></a>
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update