leakradar.
detect & fix bola at scale.
An open-core API security reconnaissance engine. Harvests JWT identity claims, prunes dynamic response volatility across three baselines, and generates automated code fixes for detected BOLA vulnerabilities before production compromise.
Baseline Volatility Normalization
False Positive Reduction Rate
Framework Code Fix Generator
Cross-Token Replay Latency
Precision
BOLA Engine.
Specifically designed for security researchers, pentest teams, and bug bounty hunters to audit REST APIs and patch authorization flaws automatically.
Automated Framework Code Fixes
Generates drop-in authorization patch code (FastAPI, Django, Express, Spring Boot) for confirmed BOLA vulnerabilities. Supports pay-as-you-go metered tokens or local air-gapped models.
3-Baseline Response Normalization
Executes triple identical User A requests before cross-token evaluation to identify and strip dynamic nonces, session timestamps, and variable request IDs automatically.
JWT Identity Claim Binding
Extracts subject claims (sub, user_id, email) directly from
authorization tokens to auto-populate parameterized endpoints.
Scalar Leaf Overlap Evaluation
Replays harvested resources with User B authentication. Measures scalar leaf matching ratios, resource ID echoing, and cross-account data exposure.
Shannon Entropy Secret Scanner
Inspects JSON payloads for exposed credentials, AWS keys, Stripe live keys, Slack webhooks, and private keys using regex rules and entropy thresholds.
Community
Core CLI scanner for individual security researchers under PolyForm Noncommercial License.
- — Full BOLA Matrix Replay Engine
- — 3-Baseline Volatility Filter
- — Redacted Markdown PoC Reports
Pro Auditor
Designed for independent penetration testers and security leads delivering client audits.
- — Full Commercial Audit License
- — Executive PDF Audits & Max Speed
- — Commercial Rights & 1 Seat
Agency Suite
For security consulting firms, MSSPs, and vCISOs delivering branded client audit reports.
- — Executive PDF Audits & Max Speed
- — White-Labeling (--logo & --company)
- — Multi-Device Seat Licensing (3 Seats)
Enterprise
Need custom auth adapters, bespoke CI/CD runners, or tailored AI models? We build to match your stack.
- — Custom AI & Air-Gapped Code Fixes
- — Custom Auth Adapters (Okta, SAML)
- — Dedicated Multi-Seat Pool & SLA