Not you? Pick your role:
Security that lives in your pipeline, not in a PDF someone emails you once a year. Baseline scan on every push — the build fails only on NEW findings, never on accepted tech debt.
340 tests · first report in ~2 minutes · no credit card required
You feel this dilemma every Friday: ship, or check?
Features weekly, deploys daily. Slowing down for a manual security review before every release is not an option — competitors will not wait.
Your customers hand you their data. Every BOLA or IDOR is their data in someone else's hands. One leak and the trust (and the contract) is gone.
If any of these hurt, this product exists for you.
Not a failed build. Not a ticket. The 3 AM message that customer data was reachable, the incident channel going quiet, the post-mortem where it turns out nobody had checked that endpoint since March. Your name is on that commit — and fixing the bug never fully fixes the story people remember.
With it in place you protect your reputation, not just your release: you stop hoping and start stating — this API is tested, on every push, here is the evidence.
Every push lights up red with 50 “findings” you already triaged. You learn to ignore the security step — until a real BOLA ships to production.
“Potential injection on /search” and nothing else. Two hours of guessing whether it is real, then another hour to prove it is not.
Friday deploy waits on a human review queue. The choice is ship blind or miss the window — both feel wrong.
Product wants Friday deploys; security wants a review week. Manually re-checking the same paths makes both lose. Automated regression on every push ends the tradeoff.
The CLI is the whole surface — no dashboard clicking required. So any coding agent (Claude Code, Cursor, Copilot, Codex) can add scanning to software you already run: it discovers the endpoints, pushes them and writes the CI gate for you. Paste this into your agent and review the diff:
Add LiveAPISec API security scanning to this repository.
1. Install the CLI: pipx install liveapisec
2. Detect my framework and existing endpoints.
3. Run: liveapisec scan-code --dir . --json
4. Add a GitHub Action that runs:
liveapisec scan --site <site_id> \
--wait --fail-on high
API key from secrets.LIVEAPISEC_KEY.
5. Show me the workflow diff before committing.# 1 · install once
$ pipx install liveapisec
# 2 · discover and register your endpoints
$ liveapisec scan-code --dir .
# 3 · scan and gate the build
$ liveapisec scan --site 6f2c --wait --fail-on high
✓ 340 tests · 0 new findings · certificate updatedSame path by hand: pipx install liveapisec → liveapisec scan-code --dir . → liveapisec scan --site <id> --wait --fail-on high. Python CLI, Python SDK and a plain REST API — whatever your agent knows best.
One GitHub Action, set once. Every push re-tests the same 340 paths automatically — no more manually re-checking endpoints before a release. Only genuine regressions break the build.
# 340 tests on every push to main
jobs:
pentest:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: liveapisec/scan@v1
with:
api-key: ${{ secrets.LIVEAPISEC_KEY }}
spec: openapi.yaml
env: staging
verdict: true
fail-on: new:highfail-on: new:high — the build breaks only on genuinely new high findings. Accepted debt stays green.
{
"verdict": "fail",
"new": [
{ "id": "F-1204", "severity": "high",
"title": "BOLA: /payments/{id} leaks
another user’s resource" }
],
"fixed": ["F-1184", "F-1183"],
"blocking": ["F-1204"]
}Fixed findings listed too — your PR description writes itself.
The actual report UI — the same one from the homepage, with payload-level evidence per finding.
The verdict endpoint diffs every scan against baseline and fails the build only on new issues. Known findings never block your deploy.
Payloads, requests, responses — everything you need to reproduce and fix in minutes, right in the dashboard. No “works on my machine”.
liveapisec push + scan from your terminal or GitHub Actions. No sales calls, no scoping docs, no waiting 3 weeks for a PDF.
SaaS or dedicated — covered both ways
Shipping single-tenant or on-prem builds? Same pipeline — a different base URL and key per customer deployment, each with isolated scans and its own certificate.
Everything below is one product — no modules, no upsell maze.
Your API is penetration-tested 24/7 against the OWASP API Security Top 10 — BOLA/IDOR, broken auth, mass assignment, injection, rate limits and more.
A transparent, always-current certificate your customers can open. See exactly what was tested, when, and what was fixed.
Most security problems appear after deploy: config changes, shadow endpoints, disabled rate limits. We watch your API continuously.
Trigger a private test on every deploy. Developers get results without touching the public certificate status.
Gate releases on NEW findings only — the verdict endpoint diffs each scan against baseline so known, accepted findings never block a deploy.
Fewer false positives. AI classifies and prioritizes findings, backed by a fully deterministic core you can reproduce.
Credentials are encrypted (AES-256) and never logged. Only you and the scanner see them.
From zero to first report faster than your coffee break.
Upload an OpenAPI, RAML, GraphQL or SOAP/WSDL spec — or point us at a URL. Add credentials — API key, Bearer, Basic or OAuth2.
The deterministic engine runs OWASP API Top 10 penetration tests on a schedule you control — or on demand — with polite pacing so your API is never overwhelmed.
Embed the live Trust Page on your site. Your customers see real, current evidence — not an empty badge.
This is what runs behind your pipeline step.
1 · Connect in under a minute
2 · 340 tests run themselves
Choose how you want to be informed — always.
3 · Critical alerts in seconds
The exact suite from our homepage — every scan, every push.
Tries to access other users’ resources by swapping identifiers in paths and queries.
Sends requests without or with a garbage token to find unprotected endpoints.
Adds extra fields to payloads to see if the server binds more than it should.
Probes SQL, NoSQL and JSON injection with error-signature detection.
Fires a burst of requests to check for missing 429 throttling.
Reflects a hostile Origin and checks whether credentials are allowed.
Checks for HSTS, X-Content-Type-Options and other hardening headers.
Looks for secrets passed in query strings instead of headers or body.
alg=none, forged payloads, weak HMAC secrets, missing exp, kid injection.
Undeclared methods (DELETE, PATCH…) that bypass per-method access control.
Undeclared role fields echoed back exactly by the server.
Stack detection with end-of-life version flagging.
.git, .env, debug endpoints, actuator, metrics, public specs, stack traces.
Unlimited login next to a limited API; limits dodged via X-Forwarded-For.
v1 endpoints that skip auth present in v2, removed endpoints still live.
Production introspection and missing query-complexity limits.
Open redirects on the authorization endpoint (code/token theft).
null Origin, lookalike-domain allowlist bypass, preflight on write endpoints.
Your server asked to fetch our URL — callback proves server-side requests.
A real pentest on every staging deploy. Watch it probe, then read the evidence.
Hundreds of OWASP API Top 10 attack simulations with polite pacing, in a safe sandbox. No vendor engagement, no waiting, no risk to production traffic.
The agent plans an attack, probes step by step, writes and runs its own sandboxed probe code when stuck, and delivers an AI-written evaluation with fixes. From Starter — dev/staging only, never production.
Same API, three base URLs. The pipeline scans each one.
This is what your dashboard shows after every scan.
Automated security tests, not a full audit. The certificate is not a guarantee of security.
Point your team — not just customers — at the same evidence.
Your API keys are encrypted at rest with AES-256-GCM and never logged or shown in plaintext.
We only scan APIs after you prove ownership with a DNS TXT record — recorded for audit.
Scans run in a sandbox with hard time and request limits so we never overload your API.
Policies, audits and evidence reporting built for enterprise procurement.
Minimal data collection, EU-hosted option, and data deletion on request.
Our team can never read your secrets; the scanner only holds them in memory during a run.
to first report
Faster than your coffee break. Try it before standup ends.
false-positive blocks
Only NEW findings fail the build. Your Fridays stay green.
tests per scan
The same OWASP attack classes auditors check — automated.
A single manual pentest costs $15,000+. Pro runs all year for less than a tenth of that. Compare all features →
No. Polite pacing with hard time/request budgets, and standard scans are read-only probes. You can also cap requests per minute per environment. Hacker mode (AI) is the only aggressive engine — and it is blocked from production entirely.
JSON: { verdict: "pass" | "fail", new: [...], fixed: [...], persisting: [...], blocking: [...] } — diffed against your baseline scan. Wire fail_on=new:high and only genuine regressions break the build.
Yes for PR preview URLs. Localhost works via our CLI tunnel — the scan runs from your machine so nothing needs to be publicly reachable.
Yes. The scanner runs in a sandbox with strict pacing, timeouts and request caps. You choose the schedule and can pause anytime.
Yes — an automated API penetration test. We run OWASP API Top 10 attack simulations (BOLA/IDOR, broken auth, injection, mass assignment, rate limiting, CORS, security headers, shadow APIs) plus deep-scan tests (JWT weaknesses, HTTP method tampering, privilege escalation via mass assignment, server tech fingerprint with EOL versions) on demand or on a schedule, like an automated pentester. It complements a human-led manual pentest rather than replacing it.
Yes. Add your API or paste an OpenAPI spec and hit “Run live pentest” — the sandbox starts testing immediately and you watch it live in the terminal. The same test is also available from our CLI (liveapisec scan) for your CI/CD.
An autonomous AI agent that runs a real, human-style penetration test on your API (dev/staging only, never production): it plans an attack, probes endpoints step by step — trying IDOR, broken auth, injections, secrets and mass assignment — observes the responses, self-corrects and writes a final evaluation with fixes. It can even write and run its own probe code in a sandbox. It runs manually on demand, requires a verified domain for public targets (localhost / private IPs are exempt), and your URL and credentials are never sent to the AI. We strongly discourage running it against production — it can break or destroy a system.
Credentials are encrypted with AES-256-GCM at rest and are only decrypted in memory during a scan. They are never logged and never shown in plaintext.
It means the API passed the automated OWASP API Top 10 tests in the tested scope on a specific date. We never claim absolute security — the certificate wording is deliberately precise.
You prove ownership with a DNS TXT record (or a manual confirm in lower tiers). Every authorization is recorded with timestamp and scope.
An endpoint is a unique HTTP method + path on a site (e.g. GET /users). Endpoints are summed across all your sites; environments share the same spec, so they do not multiply the count. Your dashboard shows live usage (X / Y endpoints) so you always know where you stand.
Every plan — including Free — includes the OWASP API Top 10 baseline suite, CI/CD webhooks, the CLI/Developer API and the public Trust Page. The Deep-scan suite (JWT, method tampering, privilege escalation, tech fingerprint and 7 more test types) starts at Starter, compliance mapping at Pro, Hacker mode (AI) at Starter, and enterprise extras (SOC 2 report, SSO, priority queue, SLA) are on Enterprise.
A manual pentest is a snapshot: $15k+, 2–4 weeks of waiting, outdated on your next deploy. We run the same OWASP attack classes continuously — every deploy, every night — for less than a tenth of the price. Use us to stay clean year-round and bring humans in once a year for the exotic stuff.
No. Standard scans are read-only probes with polite pacing, hard time/request budgets and an isolated sandbox — they cannot modify your data. Only Hacker mode (AI) is destructive, which is exactly why it is blocked from production entirely and runs on dev/staging only.
You get an alert in seconds — email, Slack or webhook, your choice — with the finding, the evidence and the fix. Critical and high findings can also block the deploy via our CI verdict endpoint, so the vulnerability never reaches production in the first place.
Yes. Upgrade is instant, downgrades apply at the next billing cycle, and you keep every existing scan and certificate. Paid plans include a 14-day money-back guarantee.
No credit card. No sales call. Results in ~2 minutes — then decide with evidence, not promises.
Scan my API free →