Thanks for helping make recruitment (and other) APIs safer.
- Contributions are under Apache 2.0.
- AuthProbe is defensive. New probes must demonstrate a flaw (e.g. prove unauthorized read access), not weaponize or exfiltrate at scale. Keep the authorized-use guardrails intact.
- Never target third-party systems in tests. Use the bundled demo targets or new
intentionally-vulnerable fixtures under
targets/.
pip install -e ".[test]"
pytest -q
python -m authprobe.demo- A login-flow auth adapter (POST credentials → bearer/cookie).
- Write-verb authorization probes (PUT/PATCH/DELETE).
- SARIF output for GitHub code scanning.
Add a test for any new probe (ideally one that fires on a vulnerable fixture and
stays silent on a secure one). Keep pytest -q green.