erev0s/VAmPI

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

1311 stars · 590 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

VAmPI is a deliberately vulnerable REST API built with Flask that implements the OWASP Top 10 vulnerabilities for APIs. It is designed for evaluating API security testing tools and for learning or teaching API security, with a global switch to toggle vulnerabilities on and off.

Use cases

• test api security scanning tools against known vulnerabilities
• practice exploiting owasp top 10 api vulnerabilities
• train developers on api security flaws
• generate false positive and false negative benchmarks for security tools
• learn rest api security with a safe vulnerable target
• test token-based authentication weaknesses

When to choose

• you need a realistic vulnerable API target for testing security scanners
• you want a controlled environment with a vulnerability on/off switch
• you are teaching or learning OWASP API security concepts
• you need OpenAPI 3 specs and Postman collections for a test API

When to avoid

• you need a production-ready secure API framework
• you want to secure a real application rather than practice on a dummy one
• you need non-REST API types like GraphQL or gRPC test targets

Facets

application · maturity active

security web-framework api-framework testing penetration-testing security apis penetration-testing developer-tools education python self-hosted vulnerable-app owasp-api-top-10 security-training deliberately-vulnerable flask openapi api-security-testing docker web-server

Member repositories

For agents

markdown · JSON · MCP: product_card(name="erev0s/VAmPI")