REST API Scanning

Dino now scans REST end to end: OpenAPI discovery, 19 fuzz strategies across 6 attack surfaces, response validation, and a real --fail-on-high CI gate.

Dino now scans REST. Until now Dino spoke GraphQL; v0.4.0 teaches it REST end to end. Point it at an OpenAPI spec and get the same depth you already get for GraphQL: security fuzzing, correctness checks, and catalog reporting with health scores.

OpenAPI discovery

A new discovery plugin parses OpenAPI 3.0 and 3.1, extracts your operations into a typed catalog, and flags collisions with typed warnings (#1039, #1040). Dino auto-detects whether an API is GraphQL or REST and routes to the right plugin, so mixed-protocol projects work out of the box (#1041).

19 fuzz strategies across 6 attack surfaces

The REST fuzzer covers body, path, query, method, content-type, and headers (#1042, #1045, #1046). Schema-constraint strategies test enum bypass, format bypass, numeric boundaries, string length, mass assignment, and read-only injection (#1043, #1048). Four header-injection strategies probe auth bypass (empty, malformed, and JWT alg:none tokens), host injection, IP spoofing across seven proxy headers, and CORS origin reflection (#1044, #1073).

A real CI gate

validateResponseAgainstSpec checks responses against your OpenAPI schema, status codes, content types, and shapes included. And the long-standing footgun is fixed: dino scan used to exit 0 no matter what it found. Now dino scan --fail-on-high exits 1 on any HIGH or CRITICAL finding (#1012, #1071), so broken auth never ships from CI.

Quick mode runs a focused set on a 3-minute budget for CI; full mode runs all 19 strategies with adaptive rate limiting and concurrency control.