OWASP/www-project-api-security-testing-framework

OWASP Foundation web repository

Stars: 150
Forks: 41
Open beginner issues: 0
Indexed issues: 14
Avg merge: 2d 5h
Merged PRs (30d): 3

Dominant language: Java
License: Apache-2.0
Last GitHub push: Sep 16, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: No code of conduct
Beginner labels: help wanted

Beginner friendly Everything

Open All

14 open issues indexed

[FEATURE] Github Action Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/www-project-api-security-testing-framework#129 · Opened Sep 12, 2026
[FEATURE] Logging of evidence Open

enhancement help wanted

Difficulty 4/5 3-5 days Newbie friendliness 50/100

OWASP/www-project-api-security-testing-framework#127 · 2 comments · Opened Aug 16, 2026
ConfigLoader ignores requestBody on inline config-file endpoints Open

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

OWASP/www-project-api-security-testing-framework#125 · Opened Aug 2, 2026
VAmPI row 9 (JWT weak signing key) may be permanently unverifiable — consider reclassifying Open

question

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/www-project-api-security-testing-framework#123 · Opened Aug 2, 2026
Decision needed: fund API credits to verify crAPI chatbot compliance (rows 16-18), or accept as permanent Partial Open

question

Difficulty 5/5 Over a week Newbie friendliness 25/100

OWASP/www-project-api-security-testing-framework#122 · Opened Aug 2, 2026
Stretch goal: generic numeric boundary/sign-manipulation test case (unlocks crAPI rows 5/8/9/10) Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/www-project-api-security-testing-framework#121 · Opened Aug 2, 2026
crAPI row 12: NoSQL injection breadth beyond login-shaped bodies Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 68/100

OWASP/www-project-api-security-testing-framework#120 · Opened Aug 2, 2026
DVGA row 22: JWT-forge argument-based auth bypass field-name heuristic too narrow Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 55/100

OWASP/www-project-api-security-testing-framework#119 · Opened Aug 2, 2026
DVGA row 21: stack-trace/debug-error disclosure check not wired into GraphQL test case Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 55/100

OWASP/www-project-api-security-testing-framework#118 · Opened Aug 2, 2026
DVGA row 19: brute-force check not wired into GraphQL test case Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 55/100

OWASP/www-project-api-security-testing-framework#117 · Opened Aug 2, 2026
DVGA row 17: deny-list bypass keyword heuristic too narrow Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 64/100

OWASP/www-project-api-security-testing-framework#116 · Opened Aug 2, 2026
DVGA row 13: no log-injection/spoofing test via GraphQL operation name Open

enhancement

Difficulty 3/5 1-2 days Newbie friendliness 68/100

OWASP/www-project-api-security-testing-framework#115 · Opened Aug 2, 2026
Verify existing checks against crAPI rows 11/13/15 (SSRF, SQLi, JWT sub-attacks) — never pointed at the specific endpoints Open

enhancement

Difficulty 4/5 3-5 days Newbie friendliness 52/100

OWASP/www-project-api-security-testing-framework#114 · Opened Aug 2, 2026
No test for multi-step business flows (e.g. password-reset-for-another-user) Open

enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

OWASP/www-project-api-security-testing-framework#103 · Opened Jul 25, 2026

A short digest of beginner-friendly GitHub issues.