I Built An API Security Scanner That Won't Shoot You in the Foot

Short summary

Developer built Sentinel, a CLI-first API security scanner prioritizing safety: it sends only GETs by default, requires explicit opt-in for injection tests, and separates operational errors from security findings via type-level guarantees. Tool is spec-aware and uses a manifest pattern for finding detection. Includes Anemone, a vulnerable test API demonstrating each finding type, with sample output showing detection of missing headers, JWT alg:none auth failures, and exposed inventory.

• •Sentinel is a spec-aware API security scanner built for developers and CI pipelines with safety as default behavior
• •Uses manifest-based finding detection and type-level error separation to keep security output trustworthy
• •Includes Anemone—a configurable vulnerable API for testing scanner accuracy against known vulnerability types

Generated with AI, which can make mistakes.