Enterprise deals stall on security questionnaires. LiveAPISec runs automated API penetration tests against the OWASP API Security Top 10 — continuously or on demand, in a safe sandbox — and gives you a live certificate that closes deals instead of blocking them.
340 tests · first report in ~2 minutes · no credit card required
Who are you? Get the pitch that fits:
Speaks your API's language
Everyone expects software delivered quickly. Nobody forgives a breach. This is the tension every API team lives in — and exactly what automation resolves.
Features weekly, deploys daily. Slowing down for a manual security review before every release is not an option — competitors will not wait.
Your customers hand you their data — payments, personal details, business secrets. Every BOLA or IDOR is their data in someone else's hands. One leak and the trust (and the contract) is gone.
Manual testing forces you to choose: fast or secure. Automated pentests on every deploy remove the choice — security rides along at release speed, and the certificate proves it to every customer.
A deterministic engine your team can trust, plus AI to cut the noise.
Your API is penetration-tested 24/7 against the OWASP API Security Top 10 — BOLA/IDOR, broken auth, mass assignment, injection, rate limits and more.
A transparent, always-current certificate your customers can open. See exactly what was tested, when, and what was fixed.
Most security problems appear after deploy: config changes, shadow endpoints, disabled rate limits. We watch your API continuously.
Trigger a private test on every deploy. Developers get results without touching the public certificate status.
Gate releases on NEW findings only — the verdict endpoint diffs each scan against baseline so known, accepted findings never block a deploy.
Fewer false positives. AI classifies and prioritizes findings, backed by a fully deterministic core you can reproduce.
Credentials are encrypted (AES-256) and never logged. Only you and the scanner see them.
A manual API pentest costs $15–50k and takes weeks — per test. Here is the alternative.
cheaper than a manual pentest
Pro plan $1,548/year vs $15k+ for a single one-off engagement that is outdated the next deploy.
from signup to first report
No sales calls, no scoping meetings, no waiting 3 weeks for a PDF. Point, click, evidence.
monitoring, not a snapshot
A pentest report expires on the next deploy. Continuous scans catch the regression that a yearly audit never sees.
Upload an OpenAPI, RAML, GraphQL or SOAP/WSDL spec — or point us at a URL. Add credentials — API key, Bearer, Basic or OAuth2.
The deterministic engine runs OWASP API Top 10 penetration tests on a schedule you control — or on demand — with polite pacing so your API is never overwhelmed.
Embed the live Trust Page on your site. Your customers see real, current evidence — not an empty badge.
Add a site in under a minute, then watch the scan run and the certificate appear.
Give it a name, point us at your OpenAPI spec and base URL, pick a schedule. We verify ownership, then connect instantly.
Your spec is parsed into hundreds of targeted tests across the OWASP API Top 10. Results land in your dashboard in minutes.
If anything important is found in your API, you’ll know immediately. Choose email, Slack, webhook or another channel you prefer — so you are always informed the moment we detect an issue.
Choose how you want to be informed — always.
A live report of the exact tests we run against your API.
Point us at an API — a base URL or an OpenAPI spec — and we run a real penetration test against it on demand, in a safe sandbox: hundreds of OWASP API Top 10 attack simulations with polite pacing. No vendor engagement, no waiting, no risk to your production traffic.
Beyond the automated scanner, an autonomous AI agent runs a real, human-style penetration test on your dev/staging environment — for verified domains only (localhost / private IPs are exempt). It:
Your URL and credentials are never sent to the AI — the agent only sees relative paths and the server executes requests. We strongly discourage running it against production — it can break or destroy a system, so it never runs there.
Connect the same API in every environment and scan each one as your release moves forward. The same 340 paths get re-tested automatically on every deploy — your team never checks the same endpoint twice by hand.
Attach one API to multiple environments — development, staging, production — each with its own base URL. Run a scan against any environment on demand, or let the scheduler check them continuously.
Automate the boring 90%.
Regression-testing the same endpoints before every release is machine work. We do it on every deploy and on schedule — humans only review what is genuinely new. That is how teams ship weekly without growing the security backlog.
A real certificate and the report behind it — transparent, precise and always current.
Automated security tests, not a full audit. The certificate is not a guarantee of security.
Public Trust Page · visible at trust.liveapisec.com/acme
Scan history and findings in your dashboard
Your customers stop asking “is our data safe?” and start seeing the evidence. The public Trust Page shows exactly what was tested, when, and what was fixed — with honest, precise language. No vague badges.
Embed these widgets on your site, docs or pricing page. They update automatically with every scan — live data, no manual work.
Small pill for your header or footer.
Open / fixed / tests at a glance.
Compact certificate card.
Full-width strip for your trust or pricing page.
Warn about new issues on your release path.
<a href="https://liveapisec.com/trust/acme" title="Verified by LiveApiSec" style="text-decoration:none;display:inline-block;color:inherit"><div data-liveapisec-widget data-slug="acme" data-type="badge"></div></a> <script src="https://liveapisec.com/widget.js" async></script>
Types: badge · banner · card. The whole widget is clickable (leads to your trust page) and shows only once the site passes its tests. Optional data-name="..." adds your label next to the brand.
How we keep your data, your API and your customers safe.
Your API keys are encrypted at rest with AES-256-GCM and never logged or shown in plaintext.
We only scan APIs after you prove ownership with a DNS TXT record — recorded for audit.
Scans run in a sandbox with hard time and request limits so we never overload your API.
Policies, audits and evidence reporting built for enterprise procurement.
Minimal data collection, EU-hosted option, and data deletion on request.
Our team can never read your secrets; the scanner only holds them in memory during a run.
A single manual pentest costs $15,000+ and expires on your next deploy. Pro runs all year for less than a tenth of that.
For developers and small teams getting started.
Autonomous AI pentest — dev/staging only
For side projects and trying us out. Baseline scans, free forever.
Autonomous AI pentest — dev/staging only
For teams closing enterprise deals. Full Deep suite + CI verdict.
Autonomous AI pentest — dev/staging only
For API-heavy organizations at scale.
Autonomous AI pentest — dev/staging only
For security-minded organizations at scale.
Autonomous AI pentest — dev/staging only
Free plan — no credit card required · 14-day money-back guarantee · Cancel anytime
Compare every capability side by side — no hidden limits, no fine print. Every plan is the full product.
| Feature | Free | Starter | Pro | Advance | Enterprise |
|---|---|---|---|---|---|
| Continuous API security testing | |||||
OWASP API Top 10 suite 8 deterministic test categories: BOLA/IDOR, broken auth, mass assignment, injection, rate limiting, CORS, security headers, sensitive params | ✓ | ✓ | ✓ | ✓ | ✓ |
Deep-scan suite (deterministic) JWT weaknesses (alg=none, weak HMAC, missing exp), HTTP method tampering, privilege escalation via mass assignment, server tech fingerprint + EOL versions, information disclosure (.git/.env/debug/actuator/stack traces), differential rate limits + XFF bypass, old API versions, GraphQL introspection + complexity, OAuth redirect_uri check, CORS null-origin + allowlist bypass + CSRF preflight, SSRF canary callback, shadow APIs | — | ✓ | ✓ | ✓ | ✓ |
API formats supported REST (OpenAPI/Swagger), RAML 0.8/1.0, GraphQL (introspection/SDL), SOAP (WSDL) | ✓ | ✓ | ✓ | ✓ | ✓ |
Auto-discovery of endpoints Crawls HTML/JS bundles, sitemap, probes common API paths — no OpenAPI needed | ✓ | ✓ | ✓ | ✓ | ✓ |
Shadow API & drift detection Undocumented endpoints, regressions and config changes caught between deploys | ✓ | ✓ | ✓ | ✓ | ✓ |
AI-generated test payloads Payloads tailored to your spec by an LLM | ✓ | ✓ | ✓ | ✓ | ✓ |
AI triage & false-positive filtering LLM verdicts (real / false positive) with confidence — backed by a deterministic core | ✓ | ✓ | ✓ | ✓ | ✓ |
| Continuous monitoring limits | |||||
Total endpoints Unique endpoints across all your sites | 100 | 1,000 | 5,000 | 25,000 | Custom / ∞ |
Live test frequency How often we re-test your APIs around the clock | Every 7 days | Every 24 h | Every 6 h | Every 1 h | 15 min / custom |
Manual tests / month On-demand scans you can trigger anytime | 10 | 20 | 50 | 200 | Unlimited |
Projects & URLs Organize your APIs into projects with unlimited URLs | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited |
Environments (dev / staging / prod) Test the same API against every release stage | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited |
Team users Members of your organization with dashboard access | 1 | 3 | 10 | 50 | Unlimited |
| Advanced AI testing | |||||
Hacker mode (AI) live pentest Autonomous human-style pentest that plans, probes and pivots | — | ✓ | ✓ | ✓ | ✓ |
Attack plan + revision Agent keeps an explicit attack plan and revises it as it learns | — | ✓ | ✓ | ✓ | ✓ |
Sandboxed code execution Agent writes and runs its own probe code in an isolated sandbox | — | ✓ | ✓ | ✓ | ✓ |
Guided attack goals Focus the agent on IDOR, escalation, secrets or injections | — | ✓ | ✓ | ✓ | ✓ |
| Developer experience | |||||
CI/CD webhooks Private tests triggered on every deploy — no impact on public status | ✓ | ✓ | ✓ | ✓ | ✓ |
CI verdict vs baseline Block deploys only on new findings (pass/fail + new/fixed/persisting counts) | ✓ | ✓ | ✓ | ✓ | ✓ |
CLI + Developer API liveapisec CLI (push, scan, gate releases) and REST API for agents | ✓ | ✓ | ✓ | ✓ | ✓ |
GitHub / GitLab deploy triggers Auto-connect repositories for post-deploy testing | ✓ | ✓ | ✓ | ✓ | ✓ |
Live scan progress & agent log Watch every step of a scan in real time | ✓ | ✓ | ✓ | ✓ | ✓ |
| Trust & compliance | |||||
Public Trust Page Live certificate with scan history you can show your customers | ✓ | ✓ | ✓ | ✓ | ✓ |
Embeddable widgets Badge, banner, card, counter, alert — drop-in embed on your site | ✓ | ✓ | ✓ | ✓ | ✓ |
Domain verification DNS TXT / CNAME / HTTP file proof of ownership (audit log) | ✓ | ✓ | ✓ | ✓ | ✓ |
AES-256 encrypted credentials API keys encrypted at rest, never logged | ✓ | ✓ | ✓ | ✓ | ✓ |
Scanner IP allowlist Stable egress IPs to whitelist in your firewall/WAF | ✓ | ✓ | ✓ | ✓ | ✓ |
SOC 2 evidence report Procurement-ready security report | — | — | — | — | ✓ |
Compliance mapping (PCI DSS / SOC 2 / ISO 27001 / GDPR / NIS2) Open findings grouped per framework requirement — indicative mapping for your auditor (not a certification) | — | — | ✓ | ✓ | ✓ |
SSO / SAML Single sign-on for your organization | — | — | — | — | ✓ |
Priority scan queue Your scans jump the queue | — | — | — | — | ✓ |
SLA & dedicated support Guaranteed uptime and a named engineer | — | — | — | — | ✓ |
One subscription covers all formats, all OWASP API Top 10 categories and the whole toolchain — nothing is sold separately.
Hacker mode (AI) live pentest
Autonomous human-style pentest: the agent plans an attack, probes endpoints step by step, writes and runs its own sandboxed code, and delivers an AI-written evaluation with fixes. Available from Starter — dev/staging only, never production.
✨ More formats and tests are added regularly. Enterprise gets custom protocol support and a dedicated roadmap.
Yes. The scanner runs in a sandbox with strict pacing, timeouts and request caps. You choose the schedule and can pause anytime.
Yes — an automated API penetration test. We run OWASP API Top 10 attack simulations (BOLA/IDOR, broken auth, injection, mass assignment, rate limiting, CORS, security headers, shadow APIs) plus deep-scan tests (JWT weaknesses, HTTP method tampering, privilege escalation via mass assignment, server tech fingerprint with EOL versions) on demand or on a schedule, like an automated pentester. It complements a human-led manual pentest rather than replacing it.
Yes. Add your API or paste an OpenAPI spec and hit “Run live pentest” — the sandbox starts testing immediately and you watch it live in the terminal. The same test is also available from our CLI (liveapisec scan) for your CI/CD.
An autonomous AI agent that runs a real, human-style penetration test on your API (dev/staging only, never production): it plans an attack, probes endpoints step by step — trying IDOR, broken auth, injections, secrets and mass assignment — observes the responses, self-corrects and writes a final evaluation with fixes. It can even write and run its own probe code in a sandbox. It runs manually on demand, requires a verified domain for public targets (localhost / private IPs are exempt), and your URL and credentials are never sent to the AI. We strongly discourage running it against production — it can break or destroy a system.
Credentials are encrypted with AES-256-GCM at rest and are only decrypted in memory during a scan. They are never logged and never shown in plaintext.
It means the API passed the automated OWASP API Top 10 tests in the tested scope on a specific date. We never claim absolute security — the certificate wording is deliberately precise.
You prove ownership with a DNS TXT record (or a manual confirm in lower tiers). Every authorization is recorded with timestamp and scope.
An endpoint is a unique HTTP method + path on a site (e.g. GET /users). Endpoints are summed across all your sites; environments share the same spec, so they do not multiply the count. Your dashboard shows live usage (X / Y endpoints) so you always know where you stand.
Every plan — including Free — includes the OWASP API Top 10 baseline suite, CI/CD webhooks, the CLI/Developer API and the public Trust Page. The Deep-scan suite (JWT, method tampering, privilege escalation, tech fingerprint and 7 more test types) starts at Starter, compliance mapping at Pro, Hacker mode (AI) at Starter, and enterprise extras (SOC 2 report, SSO, priority queue, SLA) are on Enterprise.
A manual pentest is a snapshot: $15k+, 2–4 weeks of waiting, outdated on your next deploy. We run the same OWASP attack classes continuously — every deploy, every night — for less than a tenth of the price. Use us to stay clean year-round and bring humans in once a year for the exotic stuff.
No. Standard scans are read-only probes with polite pacing, hard time/request budgets and an isolated sandbox — they cannot modify your data. Only Hacker mode (AI) is destructive, which is exactly why it is blocked from production entirely and runs on dev/staging only.
You get an alert in seconds — email, Slack or webhook, your choice — with the finding, the evidence and the fix. Critical and high findings can also block the deploy via our CI verdict endpoint, so the vulnerability never reaches production in the first place.
Yes. Upgrade is instant, downgrades apply at the next billing cycle, and you keep every existing scan and certificate. Paid plans include a 14-day money-back guarantee.
No credit card. No sales call. Results in ~2 minutes — then decide with evidence, not promises.
Run my free pentest →