API Request Security Checker

Paste the request and optional response headers to get a review report. Checks use the supplied text and do not probe the API endpoint.

Runs locally in your browser
This is a text-only local review. VoriTools never sends, replays, or scans the URL in your request.
Request or cURL command
Response headers Optional; paste only headers, not a sensitive response body.
Review summary
  • Paste a request and optional response headers to review common API risks.

A focused review, not a penetration test

The checker evaluates only visible copied text and rules that are safe to assess locally. It cannot discover authorization flaws, rate limits, server behavior, or vulnerabilities in a live API.

How to review a copied API request

Paste the HTTP request or cURL command exactly as you copied it, and optionally the response headers. The review reads that text, applies a fixed rule set and lists what deserves a second look.

Everything is computed in the browser. The request is never sent, replayed or scanned, so copied production traffic is safe to review as long as no real credentials stay in shared text.

  1. Paste a full request line with its headers (and body when there is one), or a cURL command beginning with curl; the response headers go in the second box.
  2. Press Review copied request. The summary counts high-risk findings and review items, and each finding names the header or URL part it came from.
  3. Read the level first: a red line is a combination that browsers or reviewers treat as unsafe, a yellow line is worth checking.
  4. Press Copy review to take the plain-text list of findings, for example into a ticket; Clear empties both boxes for the next request.
  5. Confirm anything you plan to change for real on the server or gateway that answers the endpoint, because the review only sees the text you pasted.

What the review checks and where it stops

What the review checks

Transport: whether the target is https, plain http, another scheme such as ftp, or has no absolute target at all.

Credentials: secrets in the query string or in JSON and form bodies, user:password inside the URL, Basic authentication in the Authorization header or through a cURL -u flag, cookie data carried by -b, and requests to sensitive-looking paths without an Authorization or X-API-Key header.

Response headers and cookies

From the response headers the review reads the CORS origin and credentials combination, the Secure, HttpOnly and SameSite attributes of every Set-Cookie value, a missing content type, a redirect to http, and technology disclosure headers such as Server or X-Powered-By.

A request with a body but no Content-Type header is reported as well, and a sensitive-looking endpoint without Cache-Control is listed as a review item.

Where the review stops

The rules only see copied text. They cannot find authorization flaws, rate limits, server behaviour or vulnerabilities in a live API, and a clean report is not a security guarantee.

cURL flag values such as -o, -w, -u and -b are read as flag values, not as the URL, and commands that use --header=value or --data=value are understood; -I is treated as a HEAD request.

Recent tools: