VulnLogic CLI

Free, zero-config API penetration testing from your terminal.

The free tier runs 6 deterministic logic-flaw modules — IDOR, Mass Assignment, Function-Level Auth Bypass, Horizontal Privilege Escalation, Race Condition, and Workflow Bypass — with no signup, no API key, and no manual setup. The CLI automatically creates its own test accounts against your target when you don't supply a token.

A full 63-module platform (SQLi, SSRF, JWT attacks, PDF reports, dashboards) is in development — get notified when it ships.

Never used a terminal before?

No problem — here is everything you need, step by step.

1. Open a terminal.

• Mac: press Cmd + Space, type Terminal, hit Enter.
• Windows: press the Windows key, type PowerShell, hit Enter.
• Linux: press Ctrl + Alt + T.

2. Check if Python is installed. Type this and press Enter:

python3 --version

If you see something like Python 3.11.5, skip to step 4. If you see "command not found," install Python first (step 3).

3. Install Python (only if step 2 failed).

• Mac: install Homebrew, then run brew install python@3.11.
• Windows: download Python from python.org/downloads and run the installer — check "Add Python to PATH" during setup.
• Linux: sudo apt install python3 (Ubuntu/Debian) or sudo dnf install python3 (Fedora).

4. Install VulnLogic:

pip install vulnlogic

5. Run your first scan. Replace the URL with the API you want to test:

vulnlogic scan --free --target "My API" --base-url https://api.yourapp.com --spec openapi.json

Don't have an OpenAPI spec file? Most APIs built with FastAPI, Django REST Framework, or similar frameworks expose one automatically — check /openapi.json or /swagger.json on your API's base URL.

What happens next: VulnLogic automatically creates a couple of throwaway test accounts on your API, then runs 6 security checks. If it finds something, you will see a table listing what it found and how to fix it. If not, you will get a clean "All clear" message.

Install

pip install vulnlogic

Quick Start

# Free scan — zero config, no token needed
vulnlogic scan --free --target myapi --base-url https://api.acme.com --spec openapi.json

That's it. VulnLogic will register its own throwaway test accounts against your target, run all 6 free modules, and report any findings.

Usage

# Free scan — no token, no signup
vulnlogic scan --free -t myapi -u https://api.acme.com -s openapi.json

# Free scan with your own token instead of auto-provisioning
vulnlogic scan --free -t myapi -u https://api.acme.com -s openapi.json --token eyJ...

# IDOR testing with two known accounts (skips auto-provisioning)
vulnlogic scan --free -t myapi -u https://api.acme.com -s openapi.json \
  --token eyJ... --victim-token eyJ...

# JSON output
vulnlogic scan --free -t myapi -u https://api.acme.com -s openapi.json --output json

# CI/CD — SARIF output + exit code 1 on high+ findings
vulnlogic scan --free -t myapi -u https://api.acme.com -s openapi.json \
  --output sarif --output-file results.sarif --fail-on high

# List available modules
vulnlogic modules

GitHub Actions Example

- name: API Security Scan (free tier)
  run: |
    pip install vulnlogic
    vulnlogic scan --free \
      --target ${{ github.repository }} \
      --base-url ${{ secrets.API_URL }} \
      --spec openapi.json \
      --output sarif \
      --output-file vulnlogic.sarif \
      --fail-on high

- name: Upload SARIF
  uses: github/codeql-action/upload-sarif@v2
  with:
    sarif_file: vulnlogic.sarif

Free Tier Modules

63 modules total are planned for the full platform, covering injection (SQLi, NoSQLi, SSRF, XXE), authentication (JWT attacks), infrastructure (CORS, GraphQL, HTTP smuggling), file upload, cryptography, WebSocket, and multi-tenant isolation — join the waitlist to get notified when they ship.