Website Security & Threat Management
Active defense: introducing a stateful vulnerability scanner for APIs

Active defense: introducing a stateful vulnerability scanner for APIs

3/9/2026 · John Cosgrove, Alex Povel, Malte Reddig

What this post added

Introduces a new stateful vulnerability scanner for APIs, initially focusing on BOLA detection. The scanner leverages OpenAPI schemas and Cloudflare's Workers AI to automatically build scan plans, inferring endpoint relationships and dependencies beyond what is explicitly defined in schemas. It integrates with Security Insights for a unified view of security findings.

Read the original post ↗