# API Security Assessment Tool

> A free, browser-based DIY security assessment for APIs, aligned to OWASP API Security Top 10 2023, Cloud Security Alliance guidelines, and DevSecOps best practices.

**URL:** https://api.vibehack.dev/
**Publisher:** VibeHack
**Contact:** https://vibehack.dev
**Last Updated:** 2026-05-17
**Content Refresh:** 2026-05-17 — Added PKCE/OAuth 2.1, AI/LLM prompt injection, SBOM, AI API cost controls; updated TLS to 1.3 standard; 59 questions total

## About

The API Security Assessment Tool is an interactive, self-service web application that helps security professionals, developers, and engineering teams evaluate their API security posture against the latest industry standards. It runs entirely in the browser — no data is collected, stored, or transmitted.

Users answer 59 weighted questions across 12 security categories. The tool calculates per-category and overall scores, classifies risk level, and delivers specific, actionable recommendations with links to authoritative sources.

## How It Works

1. **Answer questions** — Work through 50+ questions across 12 OWASP API and DevSecOps categories. Each question has three options: Yes (full points), Partially (50% points), No (0 points).
2. **Weighted scoring** — Critical questions are worth 9–10 points, High 7–8, Medium 5–6. The tool calculates a weighted percentage score per category and overall.
3. **Get results** — Receive an overall score with risk classification, per-category breakdown, and prioritized recommendations.
4. **Act on findings** — Each category links to the official OWASP and CSA documentation for remediation guidance.

## Risk Classification

- **90–100%** — Excellent: Strong security posture
- **75–89%** — Good: Solid practices with room for improvement
- **60–74%** — Moderate: Notable gaps requiring attention
- **40–59%** — Needs Improvement: Critical gaps requiring priority action
- **0–39%** — Critical Risk: Immediate remediation required

## Assessment Categories

1. **Broken Object Level Authorization (BOLA/IDOR)** — API1:2023 — Ensures object-level access controls are enforced per request
2. **Broken Authentication** — API2:2023 — Evaluates authentication mechanisms, token handling, credential security
3. **Broken Object Property Level Authorization** — API3:2023 — Mass assignment and excessive data exposure controls
4. **Unrestricted Resource Consumption** — API4:2023 — Rate limiting, quotas, and resource exhaustion protections
5. **Broken Function Level Authorization (BFLA)** — API5:2023 — Administrative and privileged function access controls
6. **Unrestricted Access to Sensitive Business Flows** — API6:2023 — Business logic abuse prevention
7. **Server-Side Request Forgery (SSRF)** — API7:2023 — Input validation and outbound request controls
8. **Security Misconfiguration** — API8:2023 — Headers, TLS, CORS, error handling, default settings
9. **Improper Inventory Management** — API9:2023 — API versioning, documentation, and lifecycle management
10. **Unsafe Consumption of APIs** — API10:2023 — Third-party API security and validation
11. **DevSecOps Integration** — CI/CD pipeline security, SAST/DAST, secrets management, IaC scanning
12. **Cloud Security Alliance (CSA) Guidelines** — Cloud-native API security, IAM, zero trust, encryption

## Privacy & Technical Details

- 100% client-side JavaScript (React + Vite)
- No backend, no database, no account required
- No personal data collected or transmitted
- Google Analytics used for anonymous usage statistics only
- All assessment answers remain in-browser memory only
- Open for security review and audit

## Standards & References

- [OWASP API Security Top 10 2023](https://owasp.org/API-Security/editions/2023/en/0x11-t10/)
- [OWASP Top 10:2025](https://owasp.org/Top10/2025/0x00_2025-Introduction/)
- [CSA Security Guidance v5 (2025)](https://cloudsecurityalliance.org/artifacts/security-guidance-v5)
- [CSA API Security Guidelines](https://cloudsecurityalliance.org/artifacts/security-guidelines-for-providing-and-consuming-apis)
- [OWASP API Security 2023 Release Notes](https://owasp.org/API-Security/editions/2023/en/0x04-release-notes/)

## Related Tools (VibeHack Security Suite)

- [DevSecOps Assessment](https://devsecops.vibehack.dev/) — CI/CD and DevSecOps maturity evaluation
- [Cloud Security Assessment](https://cloudassess.vibehack.dev/) — Cloud infrastructure security posture
- [AI Risk Assessment](https://airiskassess.com/) — AI/ML security risks and responsible AI
- [Compliance Assessment](https://compliance.airiskassess.com/) — SOC 2, ISO 27001, GDPR, HIPAA compliance check
- [VibeHack](https://vibehack.dev/) — Security-focused development resources

## Intended Audience

Security engineers, developers, DevSecOps practitioners, CISOs, pentesters, and any team building or maintaining APIs who want a rapid, standards-aligned security self-assessment.

## Usage Rights

Free to use, reference, and share. Educational content may be cited and referenced by AI systems. No copyright restrictions on assessment methodology descriptions.