# erev0s/VAmPI

Vulnerable REST API with OWASP top 10 vulnerabilities for security testing

Repository: https://github.com/erev0s/VAmPI
Canonical: https://ross.abutalabs.com/products/vampi
Language: Python
License: MIT
License Family: permissive
Topics: api, api-rest, security-tools, vulnerable-web-app
Last push: 2026-04-07T20:02:39+00:00

## Health v2 (maintenance only)
Score: 66/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 76, release rhythm 35, longevity 100
- inputs: {"age_days": 2159, "days_push": 148, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1311, forks 590 (observed 2026-08-28T04:04:20.091513+00:00)

## What it is
VAmPI is a deliberately vulnerable REST API built with Flask that implements the OWASP Top 10 vulnerabilities for APIs. It is designed for evaluating API security testing tools and for learning or teaching API security, with a global switch to toggle vulnerabilities on and off.

## Use cases
- test api security scanning tools against known vulnerabilities
- practice exploiting owasp top 10 api vulnerabilities
- train developers on api security flaws
- generate false positive and false negative benchmarks for security tools
- learn rest api security with a safe vulnerable target
- test token-based authentication weaknesses

## When to choose
- you need a realistic vulnerable API target for testing security scanners
- you want a controlled environment with a vulnerability on/off switch
- you are teaching or learning OWASP API security concepts
- you need OpenAPI 3 specs and Postman collections for a test API

## When to avoid
- you need a production-ready secure API framework
- you want to secure a real application rather than practice on a dummy one
- you need non-REST API types like GraphQL or gRPC test targets

## Facets
- artifact type: application
- maturity: active
- function: security, web-framework, api-framework, testing, penetration-testing
- domain: security, apis, penetration-testing, developer-tools, education
- platform: python, self-hosted
- tags: vulnerable-app, owasp-api-top-10, security-training, deliberately-vulnerable, flask, openapi, api-security-testing, docker, web-server

## Member repositories
- erev0s/VAmPI (main) score 66

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:20.091513+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:49:49.590261+00:00, confidence not recorded.
  - readme: https://github.com/erev0s/VAmPI (fetched 2026-08-28T04:04:20.091513+00:00, sha 6de15e795a21)
- Data as of 2026-08-30T08:39:29.467469+00:00.