API Security Detectors

The API Security scanner ships with twelve built-in detectors, each mapped to an entry of the OWASP API Security Top 10 (2023) as the primary taxonomy, and to one or more CWE identifiers as the secondary taxonomy.

Detector ID	Risk	OWASP API (2023)	CWE	Default severity
broken_object_level_authorization	Object access by ID with no ownership check (IDOR).	API1:2023	CWE-639, CWE-284	high
unauthenticated_endpoint	Endpoint reachable without authentication.	API2:2023	CWE-306	high
jwt_misconfiguration	alg: none, signature verification disabled, hardcoded HMAC secret, expiration disabled.	API2:2023	CWE-347, CWE-327, CWE-757	high (critical tiers)
sensitive_param_unauthenticated	PII / PCI / PHI / credential parameter on an unauthenticated endpoint.	API2:2023, API3:2023	CWE-359, CWE-522	high
excessive_data_exposure (Java, Python, C#, JS / TS, Go, PHP)	Response shape contains sensitivity-tagged fields the client did not ask for.	API3:2023	CWE-213, CWE-200	high
mass_assignment	Request body binds to privileged attributes (admin, role, isAdmin, …).	API3:2023	CWE-915	high (low for identity / financial fields)
pii_leak_in_response (Java, Python, C#, JS / TS, Go, PHP)	Response carries PII / PCI / PHI fields. Composite CRITICAL when combined with unauthenticated endpoint.	API3:2023, API10:2023	CWE-359	high
rate_limit_absence	Auth-required endpoint with no recognised rate-limiting library or middleware.	API4:2023	CWE-770	low
broken_function_level_authorization	Admin-shaped or destructive-verb endpoint with no role check (BFLA).	API5:2023	CWE-285, CWE-269	high
ssrf	URL-shaped input parameter; severity lifts to HIGH when the handler also performs an outgoing HTTP fetch.	API7:2023	CWE-918	low (high tier)
cors_misconfiguration	Permissive CORS (wildcard origin, especially with credentials).	API8:2023	CWE-942, CWE-346	low (high tier)
zombie_endpoint / orphan_spec	Drift between source code and OpenAPI / Swagger descriptors (shadow API or orphan operation).	API9:2023	CWE-1059	high

The full per-detector documentation — with description, rationale, vulnerable / fixed code examples per language, framework-specific remediation, and the complete reference list — is published at detectors.xygeni.io.

Per-Language Coverage

Two detectors — excessive_data_exposure and pii_leak_in_response — ship with per-language implementations so the rationale and remediation pages can speak the idiom of the target stack. Coverage:

Language	Frameworks recognised
Java	Spring MVC / Spring Boot, JAX-RS
C#	ASP.NET Core (Controllers + Minimal APIs)
Python	FastAPI, Flask, Django / Django REST Framework
JS / TS	Express, NestJS, Koa, Fastify, Hono
Go	net/http, Gin, Echo, Chi, Fiber, gorilla/mux
PHP	Laravel, Symfony, Slim

All other detectors operate at the model level (HTTP method + path shape + authentication evidence) so they apply uniformly across every supported framework. Several model-level detectors are augmented with per-language source walking that confirms or refines the verdict — for example, the BOLA / BFLA detectors walk the handler body for explicit ownership / role checks, and SSRF walks for outgoing-HTTP-fetch calls.

Sensitivity Classification

Both excessive_data_exposure and pii_leak_in_response rely on the sensitivity classifier, which tags parameters and DTO fields by their kind — PII, PCI, PHI, credential, crypto material — based on field names, schema annotations, and (where available) framework-specific markers. The classifier is configured globally on the scan, not per-detector; see the scanner configuration page for details on overriding tags for false-positive fields.

Compliance Tags

Where applicable, findings carry tags that map the underlying risk to the most relevant compliance controls:

• GDPR — Article 32 (security of processing).

• PCI-DSS v4.0 — Requirements 3.4 (render PAN unreadable), 6.4.3 (protection against payment-page tampering), 7.1 / 7.2 (least privilege), 8 (identify and authenticate access).

• NIST SP 800-53 — AC-3 (access enforcement), AC-6 (least privilege), IA-2 (identification and authentication), IA-5 (authenticator management).

Tags appear on the finding's metadata in the UI and in the JSON / SARIF report output, so API Security findings flow into existing compliance dashboards alongside SAST, SCA, and Secrets findings.