API endpoint security auditor. Scans your route files for missing auth, rate limits, CORS misconfigs, and input validation gaps. All locally, pre-commit.
One command installs APIShield and configures pre-commit hooks via Lefthook. Works with any Node, Python, Go, or Ruby project.
clawhub install apishield
Write your routes and endpoints as usual. Express, Fastify, Flask, Django, Gin, Rails — APIShield supports them all.
router.post('/admin/users', handler)
Every commit triggers a security scan. Missing auth, open CORS, no rate limits — all caught before code leaves your machine.
git commit -m "ship it"
Detects routes missing authentication middleware. Catches unprotected admin endpoints, public access to sensitive data, and missing JWT/session validation.
Identifies endpoints without rate limiting. Prevents brute force attacks, enumeration, and DoS vectors on login, search, and data-fetching routes.
Flags overly permissive CORS configurations like wildcard origins, missing credential restrictions, and exposed headers that leak sensitive data.
Checks that request bodies, query params, and URL parameters are validated and sanitized. Catches SQL injection, XSS, and prototype pollution vectors.
Automatically catalogs every endpoint across your codebase. Full inventory of routes, methods, middleware chains, and security posture at a glance.
Maps every finding to the OWASP API Security Top 10. Know exactly which compliance categories your API fails and how to remediate them.
The only pre-commit API security scanner that runs 100% locally.
| Feature | APIShield | StackHawk | Snyk API | OWASP ZAP |
|---|---|---|---|---|
| Price | Free / $19 / $39 | $35/dev/mo | $25/dev/mo | Free |
| Runs Locally | Yes | Partial | No (SaaS) | Yes |
| Pre-commit Hook | Yes | No | No | No |
| Static Analysis | Yes | No (DAST) | Yes | No (DAST) |
| Multi-framework (6+) | Yes | Partial | Yes | Partial |
| Zero Telemetry | Yes | No | No | Yes |
| OWASP Mapping | Yes | Yes | Partial | Yes |
| Auth Detection | Yes | Partial | Partial | No |
| API Inventory | Yes | Yes | Yes | No |
Start free. Upgrade when your API surface grows.
No spam. One email per week max. Unsubscribe anytime.
Scan your endpoints in seconds. Free, local, and instant.