Shadow & rogue endpoints
Inventory the APIs your spec doesn't know about. Surface routes added between deploys, forgotten v0 endpoints, and unattributed services running on stale containers.
BugDazz API Scanner
Every API change, tested before it ships.
BugDazz API Security Scanner runs inside your own infrastructure, not a hosted scan, not a human pentest. Scans every CI/CD build, on a schedule, or on demand. OWASP API Top 10, business-logic flaws, shadow endpoints. API traffic never leaves your VPC.
On-prem, API traffic never leaves your VPC
Three triggers, CI/CD · scheduled · on-demand
Buy and scan the same day
Who this is for
Built for teams shipping APIs every week.
Stay with services if
A single side-project API.
One manual pentest a year.
No release cadence to speak of.
Fit for
- 01
50+ production APIs in flight.
- 02
Weekly release cadence, or faster.
- 03
SOC 2, PCI DSS, HIPAA, or RBI scope.
- 04
AppSec / DevSecOps leads who want coverage at the speed dev ships.
Not sure where you land? Talk to a security expert.
Where your traffic goes
Nowhere. Runs inside your VPC.
Deploys into your VPC, K8s namespace, or bare metal. API traffic never leaves. Findings push out to Jenkins, ServiceNow, or Jira via webhook. Audit signs off faster, no third-party egress to review.
Find what you don't know about
Shadow APIs,discovered.
BugDazz walks your gateway, traffic mirror, and OpenAPI spec to surface every endpoint, including the ones nobody documented.
Drift detection
Diff against the previous scan. Flag new endpoints, removed routes, changed auth requirements, and contract drift before they ship to production.
Sensitive-data tagging
Mark fields carrying PII, payment data, tokens, and secrets. Map every endpoint to compliance scope, SOC 2, PCI DSS, HIPAA, DPDP, automatically.
30 minutes to first scan
On-prem install, no professional services bill.
Three steps from container pull to first finding. No agents on production hosts, no cloud egress, no ticket to platform.
- 01
Pull the image
Docker container or Helm chart from our private registry. Runs on a single VM (4 vCPU / 8 GB RAM) or a 3-node K8s namespace. License key is offline, no call-home required.
- 02
Point at your gateway
Paste your OpenAPI / Postman / HAR spec, or let the discovery probe walk your gateway. Add credentials for OAuth, JWT, API key, or mTLS once, BugDazz reuses them across every endpoint.
- 03
Run the first scan
Kick off authenticated coverage across BOLA, BFLA, mass assignment, SSRF, injection, and rate-limit abuse. First report, with proof-of-exploit per finding, lands inside the same 30-minute window.
Shorten release time
Findings ship with the pull request.
Hooks into Jenkins, GitLab CI, and GitHub Actions. Every push scans the changed surface. Criticals block the merge or route to the developer who pushed the change. Release time stays where it is, security debt does not pile up.
Plugs into your stack, CI · ticketing · identity · chat CI / CD, Ticketing & Issue tracking, Identity & Comms
How every scan works
Find. Probe. Prove.
Three stages per scan. Each one feeds the next with evidence the developer can act on.
01
01, Find
Automated discovery across every endpoint, including the ones not in your OpenAPI spec. Severity-ranked queue, not a 400-page report.
What it finds
OWASP API Top 10 plus business logic.
Every OWASP API Top 10 category, plus business-logic flaws, shadow API discovery, and JWT weaknesses. Each finding ships with reproducible request/response evidence.
Show all 44 test casesHide test cases
- 01IDOR via numeric ID enumeration
- 02IDOR via UUID / GUID brute-force
- 03Mass assignment, extra fields injected on POST
- 04Tenant isolation bypass via X-Tenant-Id override
- 05Role escalation via role / scope parameter
- 06JWT alg=none accepted
- 07JWT algorithm confusion (HS256 vs RS256)
- 08JWT signature stripped, server accepts
- 09JWT kid path traversal
- 10Refresh-token replay after rotation
- 11Session fixation via predictable IDs
- 12Password-reset token reuse
- 13Rate-limit bypass via X-Forwarded-For rotation
- 14HTTP Parameter Pollution
- 15HTTP verb tampering (POST → GET)
- 16X-HTTP-Method-Override accepted
- 17SSRF via webhook / fetch URL parameter
- 18SSRF to cloud metadata (169.254.169.254)
- 19Open redirect chained to OAuth callback
- 20GraphQL introspection enabled in production
- 21GraphQL alias / batched query DoS
- 22GraphQL field-level authorisation bypass
- 23gRPC reflection enabled
- 24WebSocket Origin bypass
- 25CORS wildcard with credentials
- 26API key leak via Referer header
- 27Webhook signature replay
- 28Race condition on /coupon /transfer /redeem
- 29TOCTOU on file-upload validation
- 30File-upload content-type bypass
- 31Path traversal in /download?file=
- 32Server-side template injection in error pages
- 33NoSQL injection ($ne, $gt operators)
- 34SQL injection via JSON body
- 35XXE via XML body
- 36LDAP injection in /search
- 37Prototype pollution via __proto__
- 38Insecure deserialization of JWT / cookie claims
- 39OTP brute force, no lockout
- 40Missing 2FA on sensitive endpoints
- 41Admin endpoint reachable from low-priv role
- 42Debug surface live (Actuator, Swagger, GraphiQL)
- 43Stale v0 / v1 endpoint discovered via path mutation
- 44Versioning regression, fix only in v2
What your team sees
Severity, posture, evidence on one pane.
Severity trend over time. Compliance posture across NIST CSF, SOC 2, GDPR, and OWASP. Open versus closed split. Every finding ships with the request and response that proved it, one click from the dashboard.
Live dashboard, severity, posture, evidence at a glance.
Platform
Three pillarsthe scanner mode owns.
Outside the scan loop and triggers, what the platform does in production.
Auth and access control
RBAC, SSO, per-team scopes. Run the platform without bolting on another dashboard.
Compliance, ready to file
Reports for PCI DSS, HIPAA, SOC 2, GDPR, NIST CSF, OWASP, generated per scan as PDF (auditor), JSON / SARIF (dev), and Excel (exec).
Beyond checklists
OWASP Top 10 is the floor. Business-logic flaws, shadow endpoints, chained findings get the same scrutiny.
FAQ
Questionsbuyers actually ask.
Coverage, footprint, and where BugDazz sits next to a managed pentest. If your question isn't here, ask a security expert.
Show all 12 questionsShow less
Operations
Security & compliance
Engagement
Still digging?
Hear from our clients
01 / 10
BugDazz handles our API volume without slowdown. The detailed reports help us keep everything secure.
Daniel Reich· Head of Corporate Security at Human Security
On record
Run it where your APIs live
See pricing. Buy a license. Scan within the hour.
No cloud egress. No scope call. No procurement queue. Pick a term, pick the seat count, invoice and on-prem container ship the same day. A named customer-success lead picks up the channel from day one.