FastAPI Security Scan

Defensive scan for FastAPI projects (FastAPI 0.100+, Pydantic v2). Reports findings using the shared scoring schema.

Scope

• **/*.py files containing APIRouter, FastAPI, or Depends
• main.py / app factory
• pyproject.toml for known-vulnerable pins

Out of scope: deployment (uvicorn/gunicorn flags), dependency CVEs.

Procedure

1. Locate the FastAPI() instance and all APIRouter instances.
2. For each route function, walk parameters and decorators.
3. Apply rules below. Emit findings in the shared schema.

Rules