APIPosture
APIPosture is self-hosted software that scans source code for potential API security and configuration issues.
What APIPosture is
APIPosture is self-hosted software that scans source code for potential API security and configuration issues. Analysis runs on the local machine or a CI/CD runner; the maker says code, findings, and project data are not sent to external servers. Its free Community Edition is an open-source CLI with eight authorization rules, AP001–AP008, including checks for unintended public access and writes missing authorization. APIPosture lists support for .NET, Go, Python, Node.js, Java, and PHP, plus frameworks such as ASP.NET Core, FastAPI, Express, Spring Boot, and Laravel. GitHub Actions, GitLab CI, and Azure DevOps integrations can run checks in a pipeline, with an option to fail builds when critical vulnerabilities are detected. Pro adds OWASP Top 10 rules, deep source and file scanning, and more than 30 secrets-detection patterns. Pro Solo costs $9 a month, billed annually at $108/year. Automated analysis does not guarantee that every vulnerability or security issue will be identified.
Good
- Local analysis keeps project data off external servers, per the maker.
- Free CLI includes eight authorization rules.
- Supports six listed programming languages.
- Integrates with GitHub Actions, GitLab CI, and Azure DevOps.
Watch out
- Automated analysis cannot guarantee detection of every issue.
- Pro Solo is $9 a month, billed annually.
Who it suits
APIPosture suits developers and teams who want local source-code checks for API security and configuration issues. The free tier covers eight authorization rules, while paid plans add scanning and team features.
Verdict
APIPosture offers a free, locally run starting point for API-focused source-code analysis. Check its rule coverage and limits against your needs, since the maker does not guarantee that automated analysis finds every issue.
Plans and prices
From APIPosture's own pricing page, checked 15 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Community Edition | Free | Open-source CLI · 100% local analysis · 8 authorization rules · CI/CD integration · Free forever |
| Pro Solo | $9 a month | 2 seats · OWASP Top 10 rules · 30+ secrets patterns · deep source/file scanning · diff mode · SQLite history · risk scoring · Billed annually at $108/year |
| Pro Team | $22 a month | 10 seats included · shared dashboards · advanced RBAC · Slack and Datadog webhooks · bulk remediation workflow · Billed annually at $264/year; per user |
| Enterprise | $150 a month | Up to 10 or 50 seats · Pro Team features · compliance/governance · security automation · flexible deployment · dedicated premium support · Scales to $300 for 50 seats |
The facts
Each one read from APIPosture's own pages, with the date it was checked.
What it does
- Authorization rules
- The free edition contains eight rules AP001 through AP008 for public access, anonymous writes, authorization conflicts, missing write authorization, role issues and exposed routes.checked 15 Oct 2026
- Broken access control
- Pro rule AP101 checks missing authorization, unauthenticated database writes and IDOR-style ownership gaps.checked 15 Oct 2026
- CI/CD integrations
- The maker lists GitHub Actions, GitLab CI, and Azure DevOps integration, with an option to fail builds when critical vulnerabilities are detected.checked 7 Oct 2026
- CI integrations
- Native CI/CD examples are provided for GitHub Actions, GitLab CI and Azure DevOps, with build failure thresholds.checked 15 Oct 2026
- CLI outputs
- The CLI supports terminal, JSON, Markdown and HTML output along with severity, route, method and framework filters.checked 15 Oct 2026
- Compliance
- The pricing page labels SOC 2 Type II audited and compliant, GDPR ready, and ISO 27001 in progress.checked 7 Oct 2026
- Compliance claims
- The platform page says it is aligned with SOC 2, ISO 27001 and HIPAA frameworks, while marking HIPAA as coming soon in its industry section.checked 15 Oct 2026
- Cryptographic checks
- AP102 identifies weak MD5 or SHA1 hashing, hardcoded cryptographic keys and sensitive-data logging.checked 15 Oct 2026
- Diff and history
- Pro supports scan diffing and stores historical results in a local SQLite database.checked 15 Oct 2026
- Documentation depth
- Documentation includes installation, CLI reference, configuration files, suppressions, output formats, security rules and CI pipeline examples.checked 15 Oct 2026
- Endpoint discovery
- The product maps API endpoints, including shadow APIs generated by tools such as Copilot or Cursor.checked 15 Oct 2026
- Enterprise support
- The Enterprise plan includes dedicated premium support; the features page also lists priority support and custom rule development.checked 7 Oct 2026
- Go package
- The Go CLI module is published under MIT and had version v1.0.10 listed on pkg.go.dev.checked 15 Oct 2026
- Injection detection
- Pro rule AP103 covers SQL and command injection, insecure deserialization and eval or exec misuse.checked 15 Oct 2026
- Install methods
- Documentation provides installers or packages for .NET, Go, Python, Java, PHP and Node.js, plus Homebrew and downloadable JAR files.checked 15 Oct 2026
- Licence
- The Python distribution is released under the MIT licence.checked 15 Oct 2026
- Limit: beta maturity
- PyPI classifies the Python project as Development Status 4 - Beta.checked 15 Oct 2026
- Limit: review evidence
- G2 displayed only one ApiPosture Pro review, written by Blago C., so independent user evidence is extremely limited.checked 15 Oct 2026
- Limit: runtime protection
- The opened product pages describe source-code scanning and CI controls but do not state that APIPosture provides runtime API blocking or live traffic protection.checked 15 Oct 2026
- Limits of analysis
- The terms state that automated analysis does not guarantee that all vulnerabilities or security issues will be identified.checked 7 Oct 2026
- Local analysis
- The maker says analysis runs locally on the machine or CI/CD runner and that code, findings, and project data are not sent to external servers.checked 7 Oct 2026
The company
- Company presentation
- The maker says its core team has more than 10 years of combined API-security and enterprise-infrastructure expertise.checked 15 Oct 2026
- Company seller
- G2 identifies the seller as APIPosture, founded in 2026, headquartered in Wyoming, United States, with one LinkedIn employee.checked 15 Oct 2026
Money
- Free rules
- The free tier includes eight authorization rules, AP001–AP008, covering issues such as unintentional public access and missing authorization on writes.checked 7 Oct 2026
Alternatives to APIPosture
- 1
42Crunch API Security Platform
Free planWebAPIExtensionLinux7.9From $9 a month - 2
Onam Security API Security
Free planWebAPILinuxmacOS7.8From $22 a month - 3
APISec Platform
Free planWebAPIExtensionLinux7.5From $690 a month - 4
DataDome API Protection
AndroidiOSWebAPI6.8From $3,830 a month - 5
Haltdos
Free planWebAPILinuxSelf-hosted6.8From $30 a month - 6
apPosture API Security
WebAPILinuxSelf-hosted6.7From $35 a month