42Crunch API Security Testing

Claude Code: /plugin marketplace add anthropics/claude-plugins-official → /plugin install 42crunch-api-security-testing@claude-plugins-official

The work is split into two phases that stay separate on purpose: an audit reads the OpenAPI document and scores it, a scan sends real requests to the live endpoint. Static reading catches missing schemas and weak security declarations, but object- and function-level authorization gaps — BOLA and BFLA — only surface when a request authenticated as one account reaches another account's resource. Findings come back grouped into quality-gate blocking, security, data validation and spec conformance tiers, named in plain language instead of rule identifiers. Each phase asks for permission before it runs, and asks again before a single fix is written back into the specification.