Why it is worth attention

It addresses the OWASP #1 API risk (BOLA) that WAFs and single-identity scanners cannot catch, and it is designed to gate CI builds with a non-zero exit code.

Who it is for

HR-tech and API development teams
Security engineers and penetration testers
Compliance and DevSecOps teams
Open-source security community

Use cases

Scanning recruitment or multi-tenant APIs for broken authorization
Integrating into CI pipelines to catch IDOR regressions before production
Automated security auditing of OpenAPI-defined endpoints
Validating that API authorization controls work correctly across identities

Strengths

Uses real multi-identity response diffing to avoid false positives
Auto-detects resource pairs from the OpenAPI spec
Provides JUnit XML output and non-zero exit codes for CI gating
Open-source under Apache 2.0 with a demo environment for quick testing

Considerations

Requires two or more controlled identities with valid credentials
Only works with APIs that expose an OpenAPI specification
Non-local targets require explicit authorization flag to run
Limited to detecting BOLA/IDOR and related flaws (not other API vulnerabilities)

README quick start

AuthProbe

An OpenAPI-driven, multi-identity BOLA/IDOR scanner for recruitment (and other) APIs. AuthProbe logs in as two or more identities you control, walks and enumerates object IDs, and diffs the responses to detect when one identity can read another's records — the Broken Object Level Authorization (BOLA/IDOR) flaw class behind incidents like McHire. It's driven by the target's OpenAPI spec and returns a non-zero exit code so it can gate your CI build.

⚠️ Authorized use only. Run AuthProbe against APIs you own or are explicitly permitted to test. It refuses non-local targets unless you pass --i-have-authorization. See SECURITY.md.

Why this exists

Broken Object Level Authorization has been the #1 OWASP API risk since 2019, and it is precisely the class of flaw that WAFs and single-identity scanners cannot catch — a BOLA request is a syntactically valid request. Finding it requires contextual, multi-identity, object-level testing: log in as A, try to read B's object, and see if it leaks. AuthProbe automates exactly that, from an OpenAPI spec, in CI.

Quickstart (30 seconds, no external target)

git clone https://github.com/jbarach2012/AuthProbe
cd AuthProbe
pip install -e ".[test]"

python -m authprobe.demo     # spins up a vulnerable + a secure demo ATS and scans both
pytest -q                    # 11 tests

Demo output:

=== Scanning VULNERABLE target ===
  [HIGH] Broken Object Level Authorization (BOLA)   alice retrieved object '2' owned by 'bob'
  [HIGH] Broken Object Level Authorization (BOLA)   bob retrieved object '1' owned by 'alice'
  [HIGH] IDOR via sequential-ID enumeration         alice reached non-owned objects [2] ...
  [MED ] Enumerable (sequential/numeric) identifiers
  summary: 4 finding(s) [high=3, medium=1]

=== Scanning SECURE target ===
  AuthProbe: no authorization findings.

Scan a real target

# 1. write a config (see examples/config.example.yaml)
# 2. run:
authprobe scan --config myconfig.yaml --format console json junit --out out/
echo "exit code: $?"   # non-zero if findings at/above fail_on

Minimal config:

target:
  base_url: "http://127.0.0.1:8000"
  spec: "auto"                       # fetch {base_url}/openapi.json
identities:
  - name: alice
    headers: { Authorization: "Bearer alice-token" }
  - name: bob

Related repositories

Similar projects matched by category, topics, and programming language.

lopopolo

Featured

harness-engineering

Harness Engineering is a methodology for improving coding agent outputs by carefully crafting the environment around them—providing curated context, tools, and executable constraints that encode an organization’s nonfunctional requirements and cumulative lessons.

AI & Machine LearningAI Agents

2,390

slvDev

Featured

esp32-ai

A 28.9 million parameter language model runs on an $8 ESP32-S3 microcontroller entirely on-device, generating simple stories at about 9.5 tokens per second.

AI & Machine LearningLarge Language Models

1,960

littledivy

Featured

mimic

mimic captures traffic from any iOS or web app and automatically generates a Python client library that lets you call the app's API like a regular library.

AI & Machine Learning

1,482