A CLI tool that audits API specifications, validates OpenAPI compliance, and runs security tests to prevent undefined user behavior.
Cherrybomb is a CLI tool that audits API specifications, validates OpenAPI compliance, and runs security tests to prevent undefined user behavior. It helps developers catch specification errors and vulnerabilities early in the development process, reducing security risks and ensuring APIs function as intended.
API developers, security engineers, and DevOps teams who need to validate OpenAPI specifications and integrate security testing into their CI/CD pipelines.
Cherrybomb offers a comprehensive, configurable approach to API validation and security testing, with detailed reporting that pinpoints issues for easy remediation. Its Rust-based performance and flexible profiles make it a robust alternative to manual specification reviews.
Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Checks OpenAPI specifications for compliance with OAS rules and best practices, ensuring APIs meet industry standards as highlighted in the README.
Offers multiple profiles like info, normal, passive, and full, allowing users to tailor audit depth based on specific testing needs.
Provides precise location information for identified problems, making it easy to fix errors with clear output examples shown in the README.
Supports configuration files for customizing testing parameters, server overrides, and security settings, enhancing adaptability for different API environments.
Installation methods for Linux/MacOS and containerized versions are deprecated, forcing users to build from source or use cargo, which can be complex and time-consuming.
Key features like the intrusive profile and config options for including/excluding checks are marked as 'in development', limiting functionality for advanced use cases.
CI pipeline integration is deprecated and will be replaced, causing instability for teams wanting to embed it immediately into their workflows without future changes.