I Built a Free API Vulnerability Scanner — It Found 23 Issues in My Own Code

Last month, I ran a security audit on a side project I'd been working on for 6 months. I thought the code was clean — proper auth headers, HTTPS everywhere, input validation on forms. Then I pointed my scanner at it and found 23 vulnerabilities . Not theoretical ones. Real, exploitable issues. Here's what happened, what the scanner found, and how you can build one yourself. The Wake-Up Call I was building an API aggregation service — something that pulls data from multiple free APIs and normalizes it. I had: API key rotation ✅ Rate limiting ✅ HTTPS only ✅ Input sanitization ✅ So what could go wrong? A lot. The 5 Categories of API Vulnerabilities After researching OWASP API Security Top 10 (2023 edition), I built a scanner that checks for these categories: 1. Broken Object Level Authorization (BOLA) The #1 API vulnerability. Your endpoint /api/users/123/data\ works for user 123 — but does it also work when user 456 requests it? import requests def check_bola ( base_url , endpoints , aut