Static security analysis for your APIs.
Find misconfigurations in seconds, not weeks. Purpose-built detection for API authorization patterns with zero false positives.
8 Security Rules. Zero False Positives.
Purpose-built detection for API authorization patterns.
Unintentional Public Access
Detects endpoints accessible without authentication that lack explicit [AllowAnonymous] declaration. Forces intentional decisions about public access.
Anonymous Write Operations
Catches [AllowAnonymous] on POST, PUT, DELETE, and PATCH operations. Prevents unintended anonymous data modifications.
Authorization Conflicts
Detects when action-level [AllowAnonymous] overrides controller-level [Authorize]. Catches conflicting authorization intent.
Missing Auth on Writes
The most critical rule: public write operations without any authorization. Your last line of defense.
Role Sprawl
Flags endpoints with 3+ roles assigned. Encourages policy-based authorization over role accumulation.
Weak Role Names
Detects generic roles: "User", "Admin", "Guest", "Manager". Promotes descriptive naming like "OrderManager" or "ReportViewer".
Sensitive Routes Exposed
Public routes with sensitive keywords: /admin, /debug, /export, /config. Customizable keyword detection.
Minimal API Gaps
Minimal API endpoints missing .RequireAuthorization() chains. Full support for modern .NET patterns.
Three Commands. Complete Visibility.
Install
Install as a global .NET tool with a single command.
dotnet tool install -g ApiPosture
Scan
Point it at your API project directory.
apiposture scan ./src
Review
Get results in Terminal, JSON, or Markdown.
--output json
No compilation required. Works with incomplete code. Syntax-only analysis powered by Roslyn.
Output That Fits Your Workflow
Shift Left. Fail Fast.
Integrate into your pipeline in one line.