security-audit

To audit API routes for authentication and authorization vulnerabilities, run a structured security audit workflow assessing route handlers and middleware across Step 0–5 checks. It identifies risks in auth/z, input validation, and data exposure without altering application code.

An API security audit is a structured assessment identifying and governing security risks across authentication, authorization, input validation, and data leakage. It evaluates web API projects to detect entitlement issues, configuration exposure, and leaked secrets.

Yes, you can check for live CVEs during an API security audit when mcp-nvd tools are configured. This enables MCP-aware vulnerability assessment with live data, providing fallback options if the connection is unavailable.

The API security audit works with native and web stacks containing route handlers and middleware. It provides step-by-step guidance tailored to your specific stack, checking applicability and generating risk remediation items.

You generate a remediation backlog from API security findings by running the audit workflow, which produces a structured report. This report contains triage-ready findings suitable for planning downstream fixes for identified vulnerabilities.

No, the API security audit does not modify application code. It performs a read-only assessment of routes and middleware, generating a standalone backlog-ready security report for review and remediation planning.