Metadata-Version: 2.5
Name: api-exposure-auditor
Version: 0.1.0
Summary: Deterministic exposure audits of public OpenAPI descriptions for admin/operator/internal surfaces.
Requires-Python: >=3.12
Requires-Dist: httpx<1,>=0.28
Requires-Dist: pydantic<3,>=2.12
Requires-Dist: pyyaml<7,>=6
Requires-Dist: typer<1,>=0.16
Description-Content-Type: text/markdown

# API Exposure Auditor

`api-exposure-auditor openapi.yaml` performs a deterministic, non-exploitative audit of a public OpenAPI 3.0/3.1 description, flagging routes, schemas, and metadata that appear intended for administrators, operators, billing systems, debugging, or internal services.

This is static analysis, not a penetration-testing tool: it never sends exploit payloads, never attempts auth bypass, and never mutates target state. An optional `--verify-safe` flag issues bounded GET/HEAD/OPTIONS requests to a small allowlist of operational endpoints (`/metrics`, `/health`, ...) to confirm live reachability — never anything else.

See the repository root `docs/` for the full architecture and development plan.
