Active defense: introducing a stateful vulnerability scanner for APIs

Cloudflare is launching a beta Web and API Vulnerability Scanner focused on Broken Object Level Authorization (BOLA), the top OWASP API threat. Unlike traditional WAFs that catch syntax-based attacks, this stateful DAST tool targets logic flaws in APIs. It builds an API call graph from OpenAPI specs using AI (OpenAI's gpt-oss-120b via Workers AI) to infer data dependencies between endpoints, then walks the graph with attacker and owner credentials to detect unauthorized access. The backend is written in Rust, uses Temporal for scan orchestration, and HashiCorp Vault Transit for credential encryption. Available in open beta for API Shield customers, with plans to expand to OWASP Web Top 10 vulnerabilities like SQLi and XSS.