About APIsec Research Labs
Open-source security research and tooling - the research arm of APIsec.
About APISec Labs
Research, innovation, and practical guidance for modern security.
APISec Labs is the public research and innovation arm of APISec.ai. We exist to advance the state of security for the systems organizations actually run today including applications, APIs, agentic workflows, identity layers, and the application infrastructure that connects them.
Security doesn’t suffer from a lack of information, but rather from fragmented knowledge, noisy advice, and too little practical guidance. APISec Labs was built to help close that gap: a dedicated space to publish what we learn, release what we build, and contribute useful signal to the security community.
What We Do
Original research on how real systems fail
We publish original technical research on API security, application risk, and emerging attack surfaces including agentic systems, AI-to-API attack paths, and identity abuse. Our work is designed to reflect and analyse how real systems fail in the real world
Explore researchOpen tools that find risk faster
We build and maintain open utilities that help security teams find risk faster including attack surface discovery, static analysis, and more. Everything we release is designed to be immediately useful, not a proof of concept that collects dust
Browse toolsActionable Intelligence on the Application Threat Landscape
We track breach patterns and ecosystem shifts affecting APIs and modern applications. Our Pulse reports are macro-view findings designed to be actionable: something a practitioner can use to prioritize and a team can use to improve their posture.
View PulseOUR PRINCIPLES
Security should be invisible
Our Cursor plugin fires OWASP rules silently - same prompt, secure output. Developers never asked for security and they got it anyway. That's the model for everything we build.
Meet developers where they are
IDE, terminal, CI/CD, browser, AI assistant. We don't build destinations - we build plugins for every surface developers already use. If it means adding security to Cursor, Claude Code, or a GitHub Action, that's where we go.
Genuinely free, honestly commercial
Every tool is free and useful standalone. We don't cripple the free version. The enterprise platform provides scale, persistence, and org-wide context - that's the business. We're transparent about both sides.
Outcomes, not findings
The industry has enough tools that generate alerts. We build tools that validate whether vulnerabilities are actually exploitable against your real attack surface. We don't add to the alert pile.
APISEC RESEARCH LABS + APISEC PLATFORM
APIsec Platform
Where the research becomes continuous protection.
APIsec Platform is our commercial product: an AI-powered security testing platform that continuously evaluates and secures APIs. It automatically maps your API endpoints and runs thousands of customized attack simulations to identify vulnerabilities and business-logic flaws before software reaches production.
Explore the platform