Object-level authz (BOLA/IDOR)
handler loads a resource by id from the path/body without checking it belongs to the caller.
The pack · 02 / 14 →
APIs
Bloodhound
the API dog. Reads your OpenAPI or GraphQL spec and handlers together for BOLA, mass assignment, SSRF and shadow routes.
invoices.ts
12invoices.get("/:id", requireUser, async (req, res) => {
13 const inv = await db.invoices.findById(req.params.id); const inv = await db.invoices.findOne({ id: req.params.id, ownerId: req.user.id });
14 res.json(inv);
15});
16
IDOR on invoices
ExploitChange the id and read any customer's invoice
FixSmallest change suggested
Bloodhound is watching$ /watchdog-go-api0 found · 0 fixed
What it does
On duty while you build.
A security lens for REST and GraphQL APIs that stays on all session, plus an on-demand audit. It reads the spec and the handlers together, because most API bugs live in the gap between them.
The always-on lens follows the OWASP API Top 10: object- and function-level authorization, broken authentication, mass assignment and over-shared fields, missing rate/size/depth limits, unbounded business flows, SSRF, misconfiguration, and shadow or zombie endpoints.
What it checks
9 things Bloodhound looks for.
Authentication
tokens decoded but not verified, no expiry, API keys in query strings, operations marked `security: []`.
Property-level authz
mass assignment (`additionalProperties: true`, spreading request bodies into models); responses returning fields the caller must not see.
Resource consumption
no rate limit, no max page size, unbounded GraphQL depth/complexity, no request size cap.
Function-level authz
admin or internal operations reachable by ordinary users.
Business flows
money/quantity fields without bounds, missing idempotency, replayable actions.
SSRF
user-supplied URLs (webhooks, imports, avatars) fetched by the server.
Misconfiguration
permissive CORS with credentials, verbose errors, `http://` servers, GraphQL introspection in production.
Inventory
routes in code but not in the spec (shadow), old versions still mounted (zombie).
Commands
Send Bloodhound out.
Runs these scanners when installed, then reads the code they can't understand:
- spectral
- semgrep
- gitleaks
Static audit of a REST or GraphQL API: inventories spec vs. routes, then checks every operation
- /watchdog-go-web
- /watchdog-go-mobile
- /watchdog-go-ai-app
- /watchdog-go-marketplace
- /watchdog-go-all
Also runs in these bundles.
Benchmark
Tested, not promised.
Its test target holds an Express + Apollo GraphQL ledger API with an OpenAPI spec: 18 planted issues, 2 decoys, an answer key, and no hint comments. Several criticals only show up by reading the router mount order in app.js against the spec.
found
Haiku 5.518/18
Sonnet 5.518/18
Opus 5.518/18
Rules of engagement
What Bloodhound will never do.
- 1
Static review only. Never hit a live API unless it is in the user's written scope.
- 2
Never print a secret's value — not keys, tokens or passwords, even weak defaults. Give file:line and the secret type only.
- 3
End each review with: what you did not check, and the top risk the user must act on.
FAQ
Bloodhound, answered.
What does Bloodhound check for?
Bloodhound is Watchdog's apis dog for Claude Code. It looks for Object-level authz (BOLA/IDOR), Authentication, Property-level authz, Resource consumption, Function-level authz, Business flows, SSRF, Misconfiguration and Inventory. Each finding comes with the exact file and line, how it could be abused, and the smallest fix.
How do I run Bloodhound in Claude Code?
Install Watchdog with /plugin marketplace add watchdoglab/watchdog and /plugin install watchdog@watchdog, then run /watchdog-go-api. Its lens also stays on while you code and flags risky lines as they're written.
Which tools does Bloodhound use?
When they're installed, Bloodhound runs spectral, semgrep and gitleaks, then reads the code those scanners can't understand. Anything it couldn't check is listed under Not checked in the report.
Is Bloodhound safe to run on my project?
Yes. Its first rule: Static review only. Never hit a live API unless it is in the user's written scope. Secrets it finds are reported by location and type only, never printed. Watchdog is free and open source (MIT).