ApiPosture
Local-first API security scanner that maps endpoints incl. shadow APIs, flags OWASP/auth flaws, and produces SOC2/ISO audit evidence.
What it does
ApiPosture is a 100% local static source-code scanner for API security. It discovers endpoints (including AI-generated shadow APIs), checks them against authorization and OWASP rules, and generates continuous compliance evidence for SOC2 and ISO frameworks.
Core features
100% local static source scanning; code never leaves the machine
Endpoint and shadow-API discovery
OWASP Top 10 and authorization rule sets
30+ secrets-detection patterns
Automated remediation guidance
SOC2/ISO 27001 evidence and risk scoring
Diff mode and historical scan tracking
Best for
→Secure AI-generated and vibe-coded APIs
→Add security gates to CI/CD pipelines
→Prepare SOC2/ISO audit evidence
→Find and map shadow endpoints
Pricing
Community
$0
Solo/Pro
$9/mo
Team
$22/mo
Enterprise
$150/mo