StackHawk
Tester that boots your application locally and attacks it the way a bad actor would: it follows auth flows, replays requests with swapped identifiers, and covers the ten most common API risks catalogued by OWASP. The vendor also ships an agent skill that chains scan, fix and rescan inside one session.
Strengths
- Tests the running application: it finds sequencing and authorisation flaws no code reading reveals
- Runs locally before the merge, so the proof lands while the fix is still cheap
- Agent skill published by the vendor: scan, fix and rescan inside one session
Limitations
- You must describe your app authentication before it is useful, then maintain that description as flows change
- A scan aimed at a shared environment can create data or trigger real side effects: keep it local
- Commercial model: the free tier is for trying, team usage is paid
Best for
- Developer exposing an API that handles user-owned data
- Team wanting proof before shipping rather than a report after an incident