---
id: 963
title: "What Vuln Scanners Miss in API Testing"
source_domain: bugcrowd.com
source_url: "https://www.bugcrowd.com/blog/what-vuln-scanners-miss-in-api-testing/"
published_at: "2020-10-14T00:00:00Z"
tags: ["access-control", "api-security", "vulnerability-scanning", "bugcrowd", "authorization", "automated-testing", "broken-authorization"]
phying_url: "https://phying.com/item/963"
lang: en
---

# What Vuln Scanners Miss in API Testing

## Summary

Luke Stephens shows how automated checks miss broken API authorization: an endpoint can pass QA while leaking users' home addresses to unauthenticated callers due to untested role restrictions.

## Intelligence Metadata

- **Sources:** bugcrowd.com
- **Published:** 2020-10-14T00:00:00Z
- **Original:** https://www.bugcrowd.com/blog/what-vuln-scanners-miss-in-api-testing/
- **Phying News:** https://phying.com/item/963