[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-94879":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":9,"totalLinesOfCode":9,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":9,"subscribersCount":16,"size":16,"stars1d":16,"stars7d":17,"stars30d":17,"stars90d":16,"forks30d":16,"starsTrendScore":16,"compositeScore":18,"rankGlobal":9,"rankLanguage":9,"license":9,"archived":19,"fork":19,"defaultBranch":20,"hasWiki":19,"hasPages":19,"topics":9,"createdAt":9,"pushedAt":9,"updatedAt":21,"readmeContent":22,"aiSummary":23,"trendingCount":16,"starSnapshotCount":16,"syncStatus":24,"lastSyncTime":25,"discoverSource":26},94879,"www-project-api-security-testing-framework","OWASP\u002Fwww-project-api-security-testing-framework","OWASP","OWASP Foundation web repository",null,"https:\u002F\u002Fgithub.com\u002FOWASP\u002Fwww-project-api-security-testing-framework","Java",98,28,6,20,0,4,43.79,false,"main","2026-08-24 04:01:22","# OWASP API Security Testing Framework\n\n[![OWASP Incubator](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Fowasp-incubator-blue.svg)](https:\u002F\u002Fowasp.org\u002Fwww-project-api-security-testing-framework\u002F)\n[![License](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Flicense-Apache%202.0-blue.svg)](https:\u002F\u002Fwww.apache.org\u002Flicenses\u002FLICENSE-2.0)\n[![CI](https:\u002F\u002Fgithub.com\u002FOWASP\u002Fwww-project-api-security-testing-framework\u002Factions\u002Fworkflows\u002Fci.yml\u002Fbadge.svg)](https:\u002F\u002Fgithub.com\u002FOWASP\u002Fwww-project-api-security-testing-framework\u002Factions\u002Fworkflows\u002Fci.yml)\n[![Tests](https:\u002F\u002Fimg.shields.io\u002Fbadge\u002Ftests-350%20passing-brightgreen.svg)](#)\n[![Release](https:\u002F\u002Fimg.shields.io\u002Fgithub\u002Fv\u002Frelease\u002FOWASP\u002Fwww-project-api-security-testing-framework?include_prereleases&label=latest)](https:\u002F\u002Fgithub.com\u002FOWASP\u002Fwww-project-api-security-testing-framework\u002Freleases\u002Flatest)\n\nA comprehensive automated testing framework for detecting API security vulnerabilities based on the **OWASP API Security Top 10 2023**.\n\n---\n\n## Quick Start\n\n### 1. Prerequisites\n\n| Requirement | Version | Why |\n|---|---|---|\n| **Java** | 21+ | The Scanner core uses Java 21 **virtual threads** for high-concurrency scanning |\n| **Maven** | 3.6+ | Required only if building from source |\n\n### 2. Download (recommended)\n\nDownload the latest pre-built JAR directly from the [GitHub Releases page](https:\u002F\u002Fgithub.com\u002FOWASP\u002Fwww-project-api-security-testing-framework\u002Freleases\u002Flatest) — no build step needed:\n\n```bash\n# Download the latest stable release\ncurl -LO https:\u002F\u002Fgithub.com\u002FOWASP\u002Fwww-project-api-security-testing-framework\u002Freleases\u002Flatest\u002Fdownload\u002Fastf-v2.0.1.jar\n```\n\nOr build from source:\n\n```bash\ngit clone https:\u002F\u002Fgithub.com\u002FOWASP\u002Fwww-project-api-security-testing-framework.git\ncd www-project-api-security-testing-framework\nmvn clean package -DskipTests\n# JAR is at: target\u002Fapi-security-testing-framework-2.0.1.jar\n```\n\n### 3. Run your first scan (copy-paste ready)\n\n**Option A — Inline flags** (quickest):\n```bash\njava -jar astf-v2.0.1.jar \\\n  -u https:\u002F\u002Fapi.example.com \\\n  --token \"YOUR_BEARER_TOKEN\" \\\n  -f HTML -o results.html -v\n```\n\n**Option B — Config file** (recommended for repeatable scans):\n```bash\njava -jar astf-v2.0.1.jar -c docs\u002Fexamples\u002Fscan-config.yaml\n```\n\n**Option C — Against OWASP crAPI** (zero-config proof of concept):\n```bash\njava -jar astf-v2.0.1.jar \\\n  -u http:\u002F\u002Fcrapi.apisec.ai \\\n  -f HTML -o crapi-report.html --timeout 3\n# Auto-discovers 832 endpoints, detects 11 vulnerability types\n```\n\nOpen the HTML report:\n```bash\n# macOS\u002FLinux\nopen crapi-report.html\n\n# Windows\nstart crapi-report.html\n```\n\n---\n\n## Releases\n\nReleases are published automatically when a version tag is pushed. The workflow runs all 350 tests, builds the fat JAR, and attaches it to the GitHub Release.\n\n| Tag format | Release type | Example |\n|---|---|---|\n| `v*-beta` | Pre-release | `v2.0.1-beta` |\n| `v*-rc*` | Release candidate | `v2.0.1-rc1` |\n| `v*` (no suffix) | Stable release | `v2.0.1` ← current |\n\n**[→ View all releases](https:\u002F\u002Fgithub.com\u002FOWASP\u002Fwww-project-api-security-testing-framework\u002Freleases)**\n\nThe JAR asset on each release is named `astf-\u003Ctag>.jar`, e.g. `astf-v2.0.1.jar`. Use this name in your CI pipelines to pin a specific version.\n\n---\n\n## Configuration Basics\n\nThe simplest config file — target URL plus a Bearer token:\n\n```yaml\n# docs\u002Fexamples\u002Fquickstart.yaml\ntarget:\n  url: \"https:\u002F\u002Fapi.example.com\"\n\nauth:\n  bearerToken: \"eyJhbGciOiJIUzI1NiJ9...\"\n\noutput:\n  format: \"HTML\"\n  file: \"results.html\"\n  verbose: true\n```\n\nFor API key authentication:\n\n```yaml\ntarget:\n  url: \"https:\u002F\u002Fapi.example.com\"\n\nauth:\n  apiKey: \"sk-abc123\"\n  apiKeyHeader: \"X-API-Key\"   # defaults to X-API-Key if omitted\n```\n\nSee [`docs\u002Fexamples\u002Fscan-config.yaml`](docs\u002Fexamples\u002Fscan-config.yaml) for the full reference covering proxy, custom headers, thread count, rate limiting, test selection, and output options.\n\n---\n\n## CLI Reference\n\n```\nUsage: astf [-hvV] [--no-discovery] [--api-key=\u003CapiKey>]\n            [--api-key-header=\u003CapiKeyHeader>] [-c=\u003CconfigFile>]\n            [--endpoints-file=\u003Cfile>] [--exclude-tests=\u003Cids>] [-f=\u003Cformat>]\n            [-o=\u003CoutputFile>] [--password=\u003Cpassword>] [--proxy=\u003CproxyUrl>]\n            [-t=\u003Cthreads>] [--test-cases=\u003Cids>] [--timeout=\u003Cminutes>]\n            [--token=\u003CbearerToken>] [-u=\u003CtargetUrl>] [--username=\u003Cusername>]\n            [--header=\u003CKey:Value>]...\n```\n\n| Flag | Short | Description | Default |\n|---|---|---|---|\n| `--url` | `-u` | Target API base URL | — |\n| `--config` | `-c` | Path to YAML\u002FJSON config file | — |\n| `--format` | `-f` | Output: `JSON`, `HTML`, `SARIF`, `XML` | `JSON` |\n| `--output` | `-o` | Output file path | stdout |\n| `--token` | | Bearer token (`Authorization: Bearer …`) | — |\n| `--secondary-token` | | Bearer token for a **second, distinct** authenticated identity — enables cross-user BOLA testing (see [Testing Guidelines](docs\u002FTESTING_GUIDELINES.md#authorization-testing-methodologies)) | — |\n| `--client-cert` | | Path to a PKCS12 (`.p12`\u002F`.pfx`) keystore with a client certificate to present for mutual TLS | — |\n| `--client-cert-password` | | Password for `--client-cert` | — |\n| `--invalid-client-cert` | | Path to a deliberately invalid\u002Funtrusted PKCS12 keystore, used alongside `--client-cert` to test whether the server actually validates client certificates | — |\n| `--invalid-client-cert-password` | | Password for `--invalid-client-cert` | — |\n| `--api-key` | | API key value | — |\n| `--api-key-header` | | Header name for API key | `X-API-Key` |\n| `--username` | | Basic auth username | — |\n| `--password` | | Basic auth password | — |\n| `--header` | | Extra header `Key:Value` (repeatable) | — |\n| `--proxy` | | Proxy URL e.g. `http:\u002F\u002Fproxy:8080` | — |\n| `--endpoints-file` | | File of endpoints to test (`METHOD \u002Fpath` per line). Skips discovery. | — |\n| `--threads` | `-t` | Concurrent threads | `10` |\n| `--timeout` | | Scan timeout in minutes | `30` |\n| `--test-cases` | | Comma-separated test case IDs to run | all |\n| `--exclude-tests` | | Comma-separated test case IDs to skip | none |\n| `--no-discovery` | | Disable auto endpoint discovery | false |\n| `--verbose` | `-v` | Verbose output | false |\n| `--version` | `-V` | Print version | — |\n| `--help` | `-h` | Show help | — |\n\n**Cross-user authorization testing example:**\n```bash\njava -jar astf.jar -u https:\u002F\u002Fapi.example.com \\\n  --token \"$USER_A_TOKEN\" --secondary-token \"$USER_B_TOKEN\"\n# Checks whether User B's identity can access\u002Fmodify objects reachable via User A's token\n# without any ID substitution — the strongest form of evidence ASTF produces for BOLA.\n```\n\n**Mutual TLS validation example:**\n```bash\njava -jar astf.jar -u https:\u002F\u002Fapi.example.com \\\n  --client-cert valid-client.p12 --client-cert-password \"changeit\" \\\n  --invalid-client-cert untrusted-client.p12 --invalid-client-cert-password \"changeit\"\n# Flags the server if it accepts the untrusted certificate just as readily as the valid one.\n```\n\n### Endpoint Input Precedence\n\nWhen multiple endpoint sources are configured, ASTF uses this order (highest wins):\n\n| Priority | Source | How |\n|---|---|---|\n| 1 | `--endpoints-file` CLI flag | Overrides everything |\n| 2 | `endpoints:` inline YAML block | In config file |\n| 3 | `endpointsFile:` YAML key | In config file |\n| 4 | Automatic discovery | OpenAPI probing + common paths |\n| 5 | Fallback hardcoded paths | When discovery finds nothing |\n\n```bash\n# Scan only specific endpoints from a file\njava -jar astf-v2.0.1.jar -u https:\u002F\u002Fapi.example.com \\\n  --endpoints-file my-endpoints.txt --token \"TOKEN\"\n\n# my-endpoints.txt format:\n# GET  \u002Fapi\u002Fv1\u002Fusers\n# GET  \u002Fapi\u002Fv1\u002Fusers\u002F{id}\n# POST \u002Fapi\u002Fv1\u002Fusers\n# DELETE \u002Fapi\u002Fv1\u002Fusers\u002F{id}\n```\n\n### Exit Codes\n\n| Code | Meaning | CI usage |\n|---|---|---|\n| `0` | Scan completed — no findings | Pipeline passes |\n| `1` | Scan completed — findings detected | Gate on HIGH\u002FCRITICAL (see CI\u002FCD section) |\n| `2` | Scan error (bad config, network failure) | Always fail pipeline |\n\n---\n\n## Test Case Catalog\n\n100% coverage of the **OWASP API Security Top 10 2023**, plus GraphQL, gRPC, mTLS, LLM, and general injection — **16 test cases** in total. See [Testing Guidelines](docs\u002FTESTING_GUIDELINES.md) for the methodology behind each category, not just what it checks.\n\n| ID | Name | Implementation Class | What It Detects |\n|---|---|---|---|\n| `ASTF-API1-2023` | Broken Object Level Authorization | `BrokenObjectLevelAuthorizationTestCase` | BOLA\u002FIDOR — numeric\u002FUUID ID substitution, unresolved-template-path resolution, and **cross-user access confirmation** (same URL, two distinct identities via `--secondary-token`, no ID guessing) |\n| `ASTF-API2-2023` | Broken Authentication | `BrokenAuthenticationTestCase` | Missing auth, JWT `none` algorithm, `kid` path traversal, RS256→HS256 algorithm confusion (via real JWKS fetch), `jku` header abuse, expired tokens, tokens in URL, username\u002Fpassword enumeration, brute-force lockout, 2FA bypass, insecure session cookies |\n| `ASTF-API3-2023` | Broken Object Property Level Authorization | `BrokenObjectPropertyLevelAuthorizationTestCase` | Password\u002Fsecret fields in responses (excessive data exposure), mass assignment via POST |\n| `ASTF-API4-2023` | Unrestricted Resource Consumption | `UnrestrictedResourceConsumptionTestCase` | Missing rate limiting (burst-request test, HTTP 429\u002F423 or body-level rejection signal) on resource-heavy endpoints |\n| `ASTF-API5-2023` | Broken Function Level Authorization | `BrokenFunctionLevelAuthorizationTestCase` | Admin endpoints reachable without elevated privileges, HTTP method escalation, and **privilege-tier path substitution** (`\u002Fuser\u002F...` → `\u002Fadmin\u002F...` on an otherwise identical request) |\n| `ASTF-API6-2023` | Unrestricted Access to Sensitive Flows | `UnrestrictedAccessToSensitiveFlowsTestCase` | Rate limiting and bot protection absent on login, OTP, payment, and password-reset flows |\n| `ASTF-API7-2023` | Server-Side Request Forgery | `ServerSideRequestForgeryTestCase` | SSRF via `url`, `webhook`, `redirect`, `callback` parameters — injects cloud metadata endpoint URLs |\n| `ASTF-API8-2023` | Security Misconfiguration | `SecurityMisconfigurationTestCase` | Missing security headers, verbose error messages, stack traces in responses |\n| `ASTF-API9-2023` | Improper Inventory Management | `ImproperInventoryManagementTestCase` | Deprecated API versions, shadow endpoints, exposed API docs |\n| `ASTF-API10-2023` | Unsafe Consumption of APIs | `UnsafeConsumptionOfApisTestCase` | Injection via webhook\u002Fintegration endpoints, open redirect in callback URLs |\n| `ASTF-GRAPHQL-2023` | GraphQL Security | `GraphQLSecurityTestCase` | Introspection, field suggestion leakage, query depth\u002Fbatch\u002Ffield-duplication\u002Falias\u002Fcircular-fragment DoS, resolver injection (SQL\u002FOS-command\u002FXSS\u002FSSRF) across every mutation and query field, GraphiQL\u002FIDE exposure, deny-list bypass via fragments, argument-based auth bypass, login brute-force, stack-trace disclosure |\n| `ASTF-GRPC-2023` | gRPC Endpoint Detection | `GrpcEndpointDetectionTestCase` | gRPC service detection over h2c, server reflection enabled (schema enumeration risk), scoped injection testing |\n| `ASTF-MTLS-2023` | Mutual TLS Validation | `MutualTlsValidationTestCase` | Whether the server actually validates client certificate trust chains, or accepts any presented certificate |\n| `ASTF-LLM-2023` | LLM Prompt Injection | `LlmPromptInjectionTestCase` | Prompt injection against LLM\u002Fchatbot-backed endpoints, via a distinctive canary-string instruction |\n| `ASTF-INJECTION-2023` | SQL\u002FNoSQL Injection | `SqlNoSqlInjectionTestCase` | General-purpose SQL\u002FNoSQL injection on REST body fields and path parameters (resolved or unresolved), independent of endpoint naming |\n| `ASTF-REDOS-2023` | Regular Expression Denial of Service | `RegexDosTestCase` | Catastrophic-backtracking-triggering payloads, detected via response-time comparison against a baseline |\n\nRun only specific test cases:\n```bash\njava -jar astf-v2.0.1.jar -u https:\u002F\u002Fapi.example.com \\\n  --test-cases ASTF-API1-2023,ASTF-API2-2023\n\njava -jar astf-v2.0.1.jar -u https:\u002F\u002Fapi.example.com \\\n  --exclude-tests ASTF-GRAPHQL-2023,ASTF-GRPC-2023\n```\n\n---\n\n## Reporting & Interpreting Results\n\n### Output Formats\n\n| Format | Flag | Best for |\n|---|---|---|\n| **HTML** | `-f HTML` | Human review — severity-coloured findings with evidence and remediation |\n| **JSON** | `-f JSON` | Programmatic processing — full `Finding` object with all fields |\n| **SARIF** | `-f SARIF` | GitHub Code Scanning dashboards and security tooling |\n| **XML** | `-f XML` | Legacy CI systems and enterprise reporting tools |\n\n### Understanding a Finding\n\nEvery finding contains these key fields (shown using a real crAPI result):\n\n```json\n{\n  \"id\": \"a3f2c1d0-...\",\n  \"title\": \"JWT 'none' Algorithm Accepted\",\n  \"severity\": \"CRITICAL\",\n  \"testCaseId\": \"ASTF-API2-2023\",\n  \"endpoint\": \"GET \u002Fapi\u002Fsearch\",\n  \"description\": \"The server accepted a JWT token signed with the 'none' algorithm,\n                  meaning no signature validation is performed.\",\n  \"evidence\": \"Server returned HTTP 200 when presented with a JWT using 'none' algorithm\",\n  \"recommendation\": \"Reject tokens with 'alg: none'. In Spring Security, configure\n                     NimbusJwtDecoder with an explicit algorithm allowlist.\"\n}\n```\n\n| Field | What it tells you |\n|---|---|\n| `severity` | CRITICAL \u002F HIGH \u002F MEDIUM \u002F LOW — prioritise fixes by this |\n| `evidence` | The exact HTTP signal that confirmed the vulnerability |\n| `recommendation` | Framework-specific fix instructions for the developer |\n| `testCaseId` | Which ASTF check triggered — maps to an OWASP category |\n| `endpoint` | The exact method + path to patch |\n\n---\n\n## CI\u002FCD Integration\n\n### GitHub Actions — Scan on Every Pull Request\n\n```yaml\nname: API Security Scan\non: [pull_request]\n\njobs:\n  security-scan:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n\n      - uses: actions\u002Fsetup-java@v3\n        with:\n          java-version: '21'\n          distribution: 'temurin'\n\n      - name: Download ASTF\n        run: |\n          curl -LO https:\u002F\u002Fgithub.com\u002FOWASP\u002Fwww-project-api-security-testing-framework\u002Freleases\u002Flatest\u002Fdownload\u002Fastf-v2.0.1.jar\n\n      - name: Run ASTF scan\n        run: |\n          java -jar astf-v2.0.1.jar \\\n            -u ${{ secrets.API_URL }} \\\n            --token ${{ secrets.API_TOKEN }} \\\n            -f SARIF -o results.sarif \\\n            --timeout 10 || echo \"ASTF_EXIT=$?\" >> $GITHUB_ENV\n\n      - name: Upload SARIF to Code Scanning\n        uses: github\u002Fcodeql-action\u002Fupload-sarif@v3\n        with:\n          sarif_file: results.sarif\n        continue-on-error: true\n\n      - name: Fail build on HIGH or CRITICAL findings\n        run: |\n          if [ \"${ASTF_EXIT}\" = \"1\" ]; then\n            echo \"ASTF detected security findings — review SARIF report\"\n            exit 1\n          fi\n```\n\n### Gate on HIGH\u002FCRITICAL only (not every finding)\n\n```bash\njava -jar astf-v2.0.1.jar \\\n  -u $API_URL --token $TOKEN -f JSON -o results.json\n\nHIGH_CRIT=$(jq '[.findings[] | select(.severity == \"HIGH\" or .severity == \"CRITICAL\")] | length' results.json)\nif [ \"$HIGH_CRIT\" -gt \"0\" ]; then\n  echo \"Build failed: $HIGH_CRIT HIGH\u002FCRITICAL findings detected\"\n  exit 1\nfi\n```\n\n---\n\n## Project Structure\n\n```\nwww-project-api-security-testing-framework\u002F\n├── src\u002F\n│   ├── main\u002F\n│   │   ├── java\u002Forg\u002Fowasp\u002Fastf\u002F\n│   │   │   ├── cli\u002F           # ASTFCli.java — picocli entry point\n│   │   │   ├── core\u002F          # Scanner, EndpointDiscoveryService, HTTP client\n│   │   │   ├── testcases\u002F     # 16 security test cases + TestCaseRegistry\n│   │   │   ├── reporting\u002F     # JSON, HTML, SARIF, XML report generators\n│   │   │   └── integrations\u002F  # GitHub Actions result processor\n│   │   └── resources\u002F\n│   │       └── log4j2.xml     # Logging configuration\n│   └── test\u002F                  # 350 unit tests\n├── docs\u002F\n│   ├── TESTING_GUIDELINES.md  # Methodology: how to test, interpret results, reduce false positives\n│   ├── FRAMEWORK_OVERVIEW.md  # Capabilities, all 16 test cases, live-verification results\n│   ├── TRACEABILITY.md        # Documented vulnerabilities vs. actual detections, per target\n│   ├── ARCHITECTURE.md        # Component design, data flow, extension guide\n│   ├── TROUBLESHOOTING.md     # Logging, common errors, issue templates\n│   └── examples\u002F\n│       ├── scan-config.yaml   # Full annotated config reference\n│       ├── scan-config.json   # JSON equivalent\n│       └── quickstart.yaml    # Minimal 3-field config\n└── .github\u002F\n    ├── workflows\u002F\n    │   ├── ci.yml             # Robo-Reviewer — runs tests on every PR\n    │   └── release.yml        # Publishes JAR to GitHub Releases on v* tags\n    └── ISSUE_TEMPLATE\u002F        # Bug, feature, docs, test-case templates\n```\n\n---\n\n## Documentation\n\n| Document | Description |\n|---|---|\n| [Testing Guidelines](docs\u002FTESTING_GUIDELINES.md) | **Start here for methodology** — testing approaches, auth\u002Fauthz\u002Fdata-validation\u002Frate-limiting strategies, result interpretation, false-positive reduction, remediation guidance |\n| [Framework Overview](docs\u002FFRAMEWORK_OVERVIEW.md) | All 16 test cases, live-verification results against real vulnerable targets, use cases |\n| [Traceability Matrix](docs\u002FTRACEABILITY.md) | Every documented vulnerability in VAmPI, crAPI, DVGA, and gRPC Goat, traced against what ASTF actually detects — published misses included, not just hits |\n| [Architecture](docs\u002FARCHITECTURE.md) | Component design, data flow, how to add a test case |\n| [Troubleshooting](docs\u002FTROUBLESHOOTING.md) | Logging config, common errors, issue templates |\n| [Full Config Reference](docs\u002Fexamples\u002Fscan-config.yaml) | Every config option with inline comments |\n| [Quickstart Config](docs\u002Fexamples\u002Fquickstart.yaml) | Minimal working config |\n| [Releases](https:\u002F\u002Fgithub.com\u002FOWASP\u002Fwww-project-api-security-testing-framework\u002Freleases) | Pre-built JARs for every version |\n\n---\n\n## Contributing\n\nWe welcome contributions! Please see [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines.\n\n**To report a bug:** [Bug Report template](.github\u002FISSUE_TEMPLATE\u002Fbug_report.md)\n**To request a feature:** [Feature Request template](.github\u002FISSUE_TEMPLATE\u002Ffeature_request.md)\n**To improve a test case:** [Test Case Enhancement template](.github\u002FISSUE_TEMPLATE\u002Ftest_case_enhancement.md)\n**To improve docs:** [Documentation Improvement template](.github\u002FISSUE_TEMPLATE\u002Fdocumentation_improvement.md)\n\nTo add a new test case, see [Adding New Test Cases](docs\u002FARCHITECTURE.md#adding-new-test-cases).\n\n### Cutting a Release (maintainers)\n\n```bash\n# 1. Ensure main is green (all CI checks pass)\n# 2. Tag and push — the release workflow does everything else\ngit tag v2.0.1\ngit push origin v2.0.1\n```\n\nThe `release.yml` workflow will run all 350 tests, build `astf-v2.0.1.jar`, and create a\nGitHub Release with the JAR attached as a downloadable asset. A plain `vX.Y.Z` tag (no\n`alpha`\u002F`beta`\u002F`rc` suffix) is published as a **stable** release; only tags matching one of\nthose suffixes are marked as a pre-release — see the [tag format table](#releases) above.\n\n---\n\n## License\n\nApache License 2.0 — see [LICENSE](LICENSE) for details.\n\n## Contact\n\n- Project Leader: [Govindarajan Lakshmikanthan](https:\u002F\u002Fgithub.com\u002FGovindarajanL)\n- OWASP Project Page: [owasp.org\u002Fwww-project-api-security-testing-framework](https:\u002F\u002Fowasp.org\u002Fwww-project-api-security-testing-framework\u002F)\n- Slack: `#project-api-security-testing-framework`\n","OWASP API安全测试框架（ASTF）是一个基于OWASP API Security Top 10 2023标准的自动化API安全漏洞检测工具。它支持对RESTful和GraphQL API进行黑盒扫描，核心特性包括高并发扫描（利用Java 21虚拟线程）、多格式报告输出（HTML\u002FJSON\u002FCSV）、Bearer Token认证集成、配置文件驱动扫描及自动端点发现。框架开箱即用，提供预编译JAR包，无需构建即可运行。适用于DevSecOps流程中的CI\u002FCD集成、API上线前安全评估及渗透测试辅助场景。",2,"2026-08-17 02:30:10","trending"]