OpenAPI Spec Security Scan

Defensive scan for OpenAPI 3.0 / 3.1 specifications. The spec is the contract — gaps here become real vulnerabilities downstream in generated servers and clients. Reports findings using the shared scoring schema.

Scope

• openapi.{yaml,yml,json}, swagger.{yaml,yml,json} (any Swagger 2.0 → upgrade)
• Files referenced via $ref (components/**, paths/**)
• Generated server stubs only as cross-reference; rules apply to the spec itself

Procedure

1. Parse the document (use yaml/json tooling; do not regex).
2. Resolve $refs to evaluate effective schemas.
3. Walk paths × methods and apply rules below.
4. Walk components.schemas for type tightness.

Rules