AuthProbe answers one question that automated tooling usually can't: can one authenticated user read another user's objects?
That is Broken Object Level Authorization (OWASP API1:2023) — the #1 API risk since 2019 and the root of large recruitment-data exposures. It is invisible to WAFs and single-identity DAST because the malicious request is syntactically valid; only multi-identity, object-level testing reveals it.
OpenAPI spec ──▶ detect (list, fetch) resources
│
identities ──▶ discover which objects each identity owns (via list endpoint)
│
▼
probes: bola · idor/enumeration · missing_auth · existence_oracle
│
▼
findings ──▶ console / JSON / Markdown / JUnit + non-zero exit for CI
See docs/diagrams/pipeline.mmd for the rendered diagram.
- Spec-driven. Resources are detected from the target's OpenAPI document, so the same config works across releases and across APIs.
- Evidence-based. A finding requires proof that the attacker identity actually received the victim's object (response diffing against a ground-truth fetch).
- CI-native. JUnit output and a severity-thresholded exit code make it a build gate, not a one-off manual test.
- Responsible. Non-local scans require an explicit authorization acknowledgment.