# blst-security/cherrybomb

Stop half-done APIs! Cherrybomb is a CLI tool that helps you avoid undefined user behaviour by auditing your API specifications, validating them and running API security tests.

Repository: https://github.com/blst-security/cherrybomb
Canonical: https://ross.abutalabs.com/products/cherrybomb
Language: Rust
License: Apache-2.0
License Family: permissive
Topics: blst, firecracker, cli, cyber, cybersecurity, business-logic, security-tools, security, api, api-security, best-practices, http, openapi, openapi3, open-source, websecurity, web-security, web-sec-scanner
Last push: 2024-10-25T10:04:00+00:00

## Health v2 (maintenance only)
Score: 23/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 0, release rhythm 8, longevity 100
- inputs: {"age_days": 1750, "days_push": 677, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1234, forks 84 (observed 2026-08-28T04:04:04.660297+00:00)

## What it is
Cherrybomb is a Rust-based CLI tool that audits OpenAPI specifications for best practices and OAS compliance, then runs security tests against the API to find undefined user behavior and vulnerabilities. It produces detailed reports pinpointing the exact location of issues.

## Use cases
- validate my OpenAPI spec against OAS rules
- audit my API specification for security issues
- find undefined user behavior in my API
- run automated security tests on my REST API
- check my API spec for best practices before release
- scan an OpenAPI file for vulnerabilities

## When to choose
- you have an OpenAPI/Swagger spec and want early detection of security and correctness issues
- you want a lightweight CLI that fits into CI pipelines for API spec auditing
- you need detailed reports showing exactly where spec problems are

## When to avoid
- your API has no OpenAPI specification
- you need runtime DAST scanning of a fully deployed production API rather than spec-based auditing
- you require a GUI or hosted SaaS scanning platform

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: security, vulnerability-scanning, cli, testing
- domain: security, apis, developer-tools, web-development
- platform: cli, windows, rust
- tags: openapi, api-security, spec-validation, business-logic, web-security-scanner, linux, macos

## Member repositories
- blst-security/cherrybomb (main) score 23

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:04.660297+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T08:22:09.576665+00:00, confidence not recorded.
  - readme: https://github.com/blst-security/cherrybomb (fetched 2026-08-28T04:04:04.660297+00:00, sha 11f27b57c4aa)
  - registry_crates: https://crates.io/api/v1/crates/cherrybomb (fetched 2026-08-29T12:21:31.365700+00:00, sha 4c6d05d6219c)
- Data as of 2026-08-30T08:39:29.467469+00:00.