Cristian Dinca

Contents

VULX

I built VULX because API security checks are much more useful when they happen while you’re building, not after something reaches production.

Chapter 3Mergedvulx into mainAPI security · developer tooling

Context

The cheapest moment to fix an API vulnerability is before the code even exists. A lot of API problems are already visible in the spec, if something actually reads it.

VULX takes an OpenAPI 3.x or Swagger 2.0 spec and checks it against all ten categories of the OWASP API Security Top 10 (2023), from broken object-level authorization to unsafe consumption of third-party APIs.

Changes

  • A Python scan engine that works through jobs from a Redis queue.
  • An Express API on PostgreSQL that stores projects and results.
  • A React dashboard to browse projects, scans and findings.
  • A CLI for automation: vulx scan --project-id <id> --fail-on HIGH fails the build when findings cross the threshold, with JSON output for pipelines.
  • Ready-made setups for GitHub Actions, GitLab CI and Jenkins.
  • PDF reports with a short summary, an OWASP coverage matrix, every finding with its evidence and fix, and a prioritized remediation roadmap.
  • Organizations with role-based access, and Stripe billing so it can run as a SaaS.

Stack

TypeScript, Python, React, PostgreSQL, Redis, Docker.

Turn the pageChapter 4: Cocofy