Cloakwave: Cloakwave detects API security issues at inception

Hello everyone,

I built Cloakwave because I kept running into the same problem with API security tools, they would tell me my spec had "BOLA risk" or "missing authentication," and I would have no idea whether that was a five minute fix or the kind of thing that ends up in a headline.

A missing auth check on an internal endpoint and a missing auth check on /admin/users are not the same problem. But most scanners treat them the same way.

So I started cataloguing documented API breaches, the ones where the root cause is public and mapped each one back to the OWASP category it belongs to. Now when the scanner flags something, it can tell you this is a technique that has been exploited repeatedly in real incidents or nobody has publicly documented exploitation of this yet, so it's lower priority. Same severity rating, very different urgency.

That's the whole idea. It runs in your browser, it's free, and your spec doesn't go anywhere. I just wanted a tool that tells me what actually matters first.

If you try it and something feels wrong, a finding that's a false positive, a category I got wrong, a gap in the precedent data, please tell me. That feedback is genuinely the most useful thing you can give me right now.

Thanks for looking.

Hello everyone,

A missing auth check on an internal endpoint and a missing auth check on /admin/users are not the same problem. But most scanners treat them the same way.

That's the whole idea. It runs in your browser, it's free, and your spec doesn't go anywhere. I just wanted a tool that tells me what actually matters first.

Thanks for looking.