Your files stay on your device

# OpenAPI security auditor

Audit a pasted Swagger or OpenAPI document for unauthenticated operations, credentials in URLs, insecure servers, and weak schemes.

Paste a document or drop a file, then press Audit document.

The audit reads what the document promises: an operation is public when security is empty or declared nowhere, credentials sitting in path or query parameters are graded critical because URLs land in logs and the Referer header, plain http server URLs are graded high, and weak schemes (API keys in query strings or cookies, basic auth, implicit OAuth flows) are named on their own rows. It does not test a running API: missing rate limits, broken CORS, or a leaked production key in a description only surface when you look. Exports are generated here in this tab.
OptionsAudit document

## More regex & cron tools

- [JSON validator](/json/validator)
- [JSON diff](/json/diff)
- [JSON query](/json/query)
[All regex & cron tools](/dev)

Was this tool useful?
YesNo

---

Canonical HTML: https://nutter.tools/dev/openapi-security-auditor
Markdown version: https://nutter.tools/dev/openapi-security-auditor.md
Plain-text version: https://nutter.tools/dev/openapi-security-auditor.txt
Agent index: https://nutter.tools/llms.txt