Inquiry Regarding Vulnerability Report and Authentication Error Handling in OFFAT

Dear Support Team,

I hope this email finds you well.

I’m currently using your tool, OFFAT, for API security testing, and I’ve been very pleased with its performance overall. It’s an effective tool that suits my needs quite well. However, I do have some concerns regarding the vulnerability report it generates.

Specifically, when I run a scan using either a correct bearer token or an incorrect one, the resulting report appears identical in both cases. As a result, I’m having difficulty distinguishing between a valid scan and one based on an incorrect token. Additionally, the tool doesn’t seem to provide any error message when authentication fails.

I understand that OFFAT still performs checks for authentication bypass even when credentials are incorrect, but it would be greatly beneficial if the tool could provide an error message, similar to the one shown when a file is unavailable, whenever there’s an issue with the bearer token or another authentication failure during a scan.

Any insights or guidance you can provide on this would be greatly appreciated. Thank you for your attention to this matter, and I look forward to your response.

Best regards,
Akshay.

Start by reproducing a scan with valid and invalid bearer tokens, then trace how authentication failures and vulnerability reports are handled. Done means invalid credentials produce a clear authentication error or otherwise distinguishable result from a valid scan, with the existing unavailable-file error behavior as a reference.