Issues

• GraphQL suite reruns per endpoint (duplicate findings) and a target crash silently hides later checks

  OWASP/www-project-api-security-testing-framework#140 · Filter by author dhaduvaivivek opened on Oct 13, 2026

• [FEATURE] Github Action

  enhancement
  OWASP/www-project-api-security-testing-framework#129 · Filter by author DominikZig opened on Sep 12, 2026 · v2.1.0

• [FEATURE] Logging of evidence

  enhancementhelp wanted
  OWASP/www-project-api-security-testing-framework#127 · Filter by author martinmolema opened on Aug 16, 2026 · v2.1.0
  2

• VAmPI row 9 (JWT weak signing key) may be permanently unverifiable — consider reclassifying

  question
  OWASP/www-project-api-security-testing-framework#123 · Filter by author GovindarajanL opened on Aug 2, 2026

• Decision needed: fund API credits to verify crAPI chatbot compliance (rows 16-18), or accept as permanent Partial

  question
  OWASP/www-project-api-security-testing-framework#122 · Filter by author GovindarajanL opened on Aug 2, 2026

• Stretch goal: generic numeric boundary/sign-manipulation test case (unlocks crAPI rows 5/8/9/10)

  enhancement
  OWASP/www-project-api-security-testing-framework#121 · Filter by author GovindarajanL opened on Aug 2, 2026

• crAPI row 12: NoSQL injection breadth beyond login-shaped bodies

  enhancement
  OWASP/www-project-api-security-testing-framework#120 · Filter by author GovindarajanL opened on Aug 2, 2026 · v2.1.0
  1

  

• DVGA row 22: JWT-forge argument-based auth bypass field-name heuristic too narrow

  enhancement
  OWASP/www-project-api-security-testing-framework#119 · Filter by author GovindarajanL opened on Aug 2, 2026

• DVGA row 21: stack-trace/debug-error disclosure check not wired into GraphQL test case

  enhancement
  OWASP/www-project-api-security-testing-framework#118 · Filter by author GovindarajanL opened on Aug 2, 2026

• DVGA row 19: brute-force check not wired into GraphQL test case

  enhancement
  OWASP/www-project-api-security-testing-framework#117 · Filter by author GovindarajanL opened on Aug 2, 2026

• DVGA row 17: deny-list bypass keyword heuristic too narrow

  enhancement
  OWASP/www-project-api-security-testing-framework#116 · Filter by author GovindarajanL opened on Aug 2, 2026

• DVGA row 13: no log-injection/spoofing test via GraphQL operation name

  enhancement
  OWASP/www-project-api-security-testing-framework#115 · Filter by author GovindarajanL opened on Aug 2, 2026
  1

• Verify existing checks against crAPI rows 11/13/15 (SSRF, SQLi, JWT sub-attacks) — never pointed at the specific endpoints

  enhancement
  OWASP/www-project-api-security-testing-framework#114 · Filter by author GovindarajanL opened on Aug 2, 2026

• No test for multi-step business flows (e.g. password-reset-for-another-user)

  enhancement
  OWASP/www-project-api-security-testing-framework#103 · Filter by author GovindarajanL opened on Jul 25, 2026