No. 5 of 27 ·API Security Testing Software

VulnAPI

Windows · Mac · Linux · Self-hosted

Freedom report

Three barsScore 6.5

Free tierA free tier is on its own pricing page
Open codeNo open-source code on record
Runs widely3 of 6 device platforms
DocumentedPlans, terms and facts published

VulnAPI is ranked #5 of 27 in API security testing software on Freedom251. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

VulnAPI plans and pricing

All plans

Open source (MIT License) Free Free to use, modify, and distribute for educational and testing purposes github.com · 3 Oct 2026

Compared on API security testing software

API discovery: Yes
Authentication testing: Yes
Authorization testing: Yes
Input-validation testing: Yes
Business-logic testing: Yes
Deployment: self-hosted
API formats: REST, OpenAPI, GraphQL, curl-like requests

Best VulnAPI alternatives

See all 12

Two bars 42Crunch API Security Platform Free tier No. 1$9/mo6.6 One bar APISec Platform Free tier No. 2$690/mo6.5 One bar Pynt Free tier No. 3Free6.5 Two bars Schemathesis Free tier No. 4Free6.5 One bar AquilaX API Security Scanner Free tier No. 6$19/mo6.4 One bar Beagle Security Free tier No. 7$99/mo6.4

The record

What it does: VulnAPI is an open source dynamic application security testing tool that scans APIs for vulnerabilities and security risks.
Scan methods: It scans APIs through a curl-like CLI, OpenAPI contracts, or a GraphQL endpoint.
OWASP coverage: The product page says VulnAPI detects all ten OWASP API Security Top 10 categories out of the box.
Reports: Scan reports include the risk level, vulnerability, description, and operation where the finding was detected.
CI/CD integrations: The maker lists GitHub Actions, GitLab CI, and Jenkins as supported CI/CD pipeline integrations.
Installation: Pre-built binaries and installation instructions are provided for Linux, Windows, and macOS, with Docker also available.
Custom scans: The product page says teams can tailor security assessments to their requirements and environments.
Remediation guidance: The product page says findings include a plain-English description, the triggering request, and concrete remediation steps.
Telemetry: The scanner collects anonymous usage data about scan counts and detected vulnerability counts and severity; users can opt out with a command-line flag.
Proxy support: The scanner supports proxy configuration through HTTP_PROXY or HTTPS_PROXY environment variables or a --proxy argument.
Target audience: The product page describes VulnAPI as built for security-minded teams.
Support channel: The repository invites users to request additional vulnerability checks or best practices by opening an issue or submitting a pull request.
Price from: Free

Where it ranks on Freedom251

Best API Security Testing Software in 2026#5 of 27

Is VulnAPI yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote VulnAPI

Sources

cerberauth.com/docs/vulnapi/· checked 3 Oct 2026
cerberauth.com/vulnapi/· checked 3 Oct 2026
cerberauth.com/docs/vulnapi/installation/· checked 3 Oct 2026
github.com/cerberauth/vulnapi· checked 3 Oct 2026