# Changelog of OpenAPI Security Auditor (`michiganpublictech/openapi-security-auditor`) Actor

- **URL**: https://apify.com/michiganpublictech/openapi-security-auditor/changelog.md
- **Full Actor documentation**: https://apify.com/michiganpublictech/openapi-security-auditor.md

## Changelog — OpenAPI Security Auditor

### 0.1.0 — unreleased

Initial release.

- Audits Swagger 2.0, OpenAPI 3.0 and OpenAPI 3.1 documents (JSON or YAML) from URLs (`specUrls`),
  pasted text (`specText`) or API base URLs (`apiBaseUrls`, discovery over 8 well-known paths).
- Safe local `$ref` resolution (cycle-safe, depth-limited); unresolvable and external refs are reported.
  Alias-bomb protection (node cap) for YAML input.
- 50 specification rules: authentication & authorization (`OAS-AUTH-001…015`), transport (`OAS-TRAN-001…002`),
  input validation / mass assignment (`OAS-INPUT-001…008`), rate limiting (`OAS-RATE-001…004`), sensitive data
  exposure with redacted evidence (`OAS-DATA-001…004`), deprecated patterns (`OAS-DEPR-001…003`), inventory
  (`OAS-INV-001`) and specification quality (`OAS-QUAL-001…013`).
- Opt-in passive runtime checks (`runtimeChecks` + `confirmAuthorization`): TLS (`OAS-TLS-001…004`), security headers
  and plain HTTP (`OAS-HDR-001…005`), CORS (`OAS-CORS-001…003`), plus the discovery observation `OAS-DISC-001`.
- Findings are labelled `specification`, `runtime` or `observation`; the disclaimer explains the difference.
- `minSeverity` output filter (score always computed from all findings), `failOnSeverity` CI gate, `disabledRules`
  (Pro+), SARIF and Markdown reports.
- Pay-per-event pricing: `api-audited` ($0.05) per delivered report; `runtime-checks` ($0.02) only when live checks
  actually ran. Failed targets are published free of charge.