New: Active Pentest Package — Try it free
BreakMesh shield BreakMesh – Vulnerability Simulator & Cyber Range

Scanner package

API Security scanner

Coverage for the API surface most website scanners never look at — REST, GraphQL, and the dependencies behind them.

What it checks

API Security reviews API documentation exposure, HTTP method exposure, versioned endpoint discovery, endpoint auth indicators, excessive CORS configuration, sensitive response patterns, rate-limit readiness, JWT weaknesses, shadow API discovery, WebSocket security, and missing Subresource Integrity (SRI).

With consent, it also queries GraphQL introspection to map the schema, and checks for GraphQL DoS readiness against batching, alias, and depth-based abuse.

Dependency CVE matching

Paste a package-lock.json, requirements.txt, pom.xml, or CycloneDX/SPDX SBOM and BreakMesh looks up known CVEs for each dependency via the public OSV.dev database — no live probing of the target required for this check.

A headless-browser drive-by-download check is also available with consent, rendering the homepage to detect unsolicited file downloads or malicious redirect chains without submitting forms or clicking links.