OpenAPI security auditor

The audit reads what the document promises: an operation is public when security is empty or declared nowhere, credentials sitting in path or query parameters are graded critical because URLs land in logs and the Referer header, plain http server URLs are graded high, and weak schemes (API keys in query strings or cookies, basic auth, implicit OAuth flows) are named on their own rows. It does not test a running API: missing rate limits, broken CORS, or a leaked production key in a description only surface when you look. Exports are generated here in this tab.