Feature docs · API security
For modern products the real surface is often the API, not HTML. Guardbee reports CORS, JWT, GraphQL, and authenticated-traffic signals via browser capture and targeted probes.
Modules
- API Response Scanner: headless capture of fetch/XHR; leak and CORS hints
- CORS Policy: Access-Control-* headers plus an Origin reflection probe
- JWT Analysis: alg:none, long expiry, sensitive claim signals
- GraphQL Introspection: introspection probe on discovered GraphQL
- Authenticated Crawl: same-origin API traffic via login crawl
- Rate Limit Signals: RateLimit-*, Retry-After, 429 signals
Business impact
Overly open CORS, weak JWTs, or open GraphQL schemas expand data-leak and account-takeover risk. These are product risks — not “only the API team’s problem.”
Run these checks with Guardbee
Add your brand, pick the modules that matter, and get findings in business language. New accounts get 25 credits.
Frequently asked questions
Do you need credentials?
Authenticated Crawl needs brand login credentials; other API checks generally run unauthenticated.
Does every site have GraphQL?
No. Introspection runs only on discovered GraphQL endpoints.
Is this destructive testing?
No. Probes are controlled and limited.