Tools

Open-source tools for testing authorization, mapping attack surfaces, and running security workflows locally.

A common thread: broken access control is difficult to test automatically because scanners cannot infer the permissions an application intended to enforce. These tools make those rules explicit, repeatable, and cheaper to verify.

Published

Released under permissive licenses and ready to use.

Go Open source

VardrGate

Define who should be allowed to call an endpoint. VardrGate repeats the request across users and roles, then flags where actual behavior violates the policy—with request and response evidence.

Because the policy is a file, it runs in CI. Authorization gets tested on every commit rather than once a year.

Python Open source

VardrMap

Keep scope, assets, testing hypotheses, evidence, and findings in one workspace so you always know what has—and has not—been tested.

Reconnaissance and enrichment APIs feed the same workspace, so context does not end up spread across a document, an email, and a terminal scrollback.

Python Open source

VardrRunner

Run queued security jobs on your own machine while a remote backend handles orchestration and results. Credentials and scan traffic remain local.

The backend and the runner are fully decoupled and only ever exchange JSON, so orchestration never requires handing over access to the systems being tested.

In Development

Active experiments and design work. These projects are not yet supported for production use.

Python

VardrScanner

An API security testing framework focused on the OWASP API Top 3. Architecture and design notes are public; the implementation is not.

Python

VardrForge

A local CLI that generates small, modular penetration testing tools from controlled templates—with scope validation baked in. Every generated tool is restricted to an explicit target allowlist, so it cannot be pointed somewhere it was never authorized to go.

Go

VardrVault

A secrets manager with token auth, encrypted storage, and audit logging. Built mostly to understand the problem properly—you learn a great deal about a threat model by having to implement against it.

Found a bug? Have a better idea?

Issues and pull requests are welcome on any of the published repositories. If you have found something security-relevant in one of these tools, please report it privately first—the same courtesy I would ask of anyone testing a system of mine.