Shadowaudit: a static scanner for undocumented and unauthenticated Express.js routes

Short summary

Shadowaudit is an open-source static API security scanner for Express.js that uses AST-based route extraction via Babel to compare every route definition against an OpenAPI/Swagger spec. It identifies undocumented and unauthenticated routes before they merge to production, supports custom auth middleware pattern detection, and outputs findings as JSON or SARIF for CI integration. The tool can fail CI pipelines on critical findings and includes a GitHub Action for easy integration.

• •AST-based static analysis compares Express.js routes against OpenAPI specs to find shadow APIs
• •Detects default auth middleware patterns and supports custom configuration
• •Outputs JSON or SARIF formats and can fail CI on critical findings

Generated with AI, which can make mistakes.