From the maker of Routelint. The problem: Vibe-coding tools let anyone ship a working app in a weekend. But the APIs behind those apps often skip the boring checks: does this endpoint still answer with no login, and can User B read User A’s data? Those bugs (IDOR and unguarded routes) are easy to miss because the UI looks fine. What Routelint does: It records the API calls your app already makes, then replays each one three ways: with no session, as User A, and as a peer account. If User B gets back the same data as User A, you see it flagged as critical. Every scan runs five checks: API catalog of every XHR and fetch the UI made Unguarded access (data that returns with no login) Cross-user / IDOR Secret and PII exposure (tokens, cards, emails, hashes) Sensitive paths like /.env, /debug and /actuator Built to be safe to run: Scans only start after you prove you own the host (a DNS TXT record or a well-known file). Replay is read-only, and tokens, emails and cards are redacted before evidence is stored. Bonus: There’s also a free public SEO and GEO check that scores how your site reads to search engines and AI answer engines, covering crawler access, raw HTML text, structure and llms.txt. No account needed. A free account includes all five suites and three sites. Payments and daily scans are coming soon. I’d love your feedback. Which checks would you want next, and what would make you trust a scanner like this on your own app? I’ll be here all day answering questions. 🙏 Try it: https://www.routelint.com

Routelint

#testing #apitesting #seogeo #seo #geo #openroutes

#testing #apitesting #seogeo #seo #geo #openroutes