API DAST scanner
Heimdall Scan
A finding is emitted only when the evidence request replays.
A command-line scanner that crawls an OpenAPI contract, runs checks mapped to replayable OWASP API tests, and writes Markdown and SARIF with the evidence attached. The eval target is a FastAPI app. Tests run in pytest and GitHub CI.
Python, FastAPI, OpenAPI, Semgrep, pytest, Docker, CI
Result
- Precision
- 1.00
- Recall
- 1.00
- False positives
- 0
- Planted bugs
- 16
- Checks
- 6
- APIs
- 3
- Semgrep rules
- 5
Zero false positives is on a hardened control. The five Semgrep rules match method, path, and CWE.
