--- title: A Grounded Spectral Ruleset for the OWASP API Security... description: A Spectral ruleset published to npm as `@api-common/spectral-owasp-ruleset` maps all 10 OWASP API Security Top 10 (2023) categories to 22 linting rules. It... canonical: https://daily.dev/posts/a-grounded-spectral-ruleset-for-the-owasp-api-security-top-10-uvshv2uzr twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: A Grounded Spectral Ruleset for the OWASP API Security Top 10 | daily.dev og:description: A Spectral ruleset published to npm as `@api-common/spectral-owasp-ruleset` maps all 10 OWASP API Security Top 10 (2023) categories to 22 linting rules. It... og:url: https://daily.dev/posts/a-grounded-spectral-ruleset-for-the-owasp-api-security-top-10-uvshv2uzr og:image: https://api.daily.dev/og/posts/uVsHv2Uzr.png og:image:alt: A Grounded Spectral Ruleset for the OWASP API Security Top 10 og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # A Grounded Spectral Ruleset for the OWASP API Security Top 10 **[API Evangelist](https://daily.dev/sources/apievangelist)** · 3 min read · 0 upvotes · 0 comments ## Summary A Spectral ruleset published to npm as `@api-common/spectral-owasp-ruleset` maps all 10 OWASP API Security Top 10 (2023) categories to 22 linting rules. It uses only Spectral's built-in functions — no custom JavaScript required — and supports both Swagger 2.0 and OpenAPI 3.x. The ruleset is honest about static analysis limits: directly lintable checks (HTTPS, no HTTP Basic, API keys out of URLs, payload bounds) are enforced as errors, while runtime concerns like object-level authorization are flagged as advisory. It integrates in one line via `extends` in `.spectral.yaml` or via npm install, and can emit SARIF for code-scanning integration. Motivation comes from a study showing only 14% of 1,005 public API pipelines run any security rules at all. The project is open source under Apache-2.0. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Is there a Spectral ruleset that checks OpenAPI specs against the OWASP API Security Top 10? Yes, the Spectral OWASP Ruleset published to npm as @api-common/spectral-owasp-ruleset provides 22 checks covering all ten OWASP API Security Top 10 (2023) categories. It uses only Spectral's built-in functions like defined, truthy, pattern, and schema, requires no custom JavaScript, and lints both Swagger 2.0 and OpenAPI 3.x with format-gated rule variants. _Teams tightening API security gates can track new governance tooling like this via daily.dev._ ### What percentage of public API pipelines run security linting rules? Only 14 percent of 1,005 public API pipelines studied run any security rules at all, and just 3.4 percent emit SARIF output for whatever security tooling they do use. This gap in automated API security governance motivated building a dedicated OWASP-mapped Spectral ruleset that teams can add with a single line in their existing OpenAPI linting setup. _Anyone benchmarking their own API pipeline's security coverage can follow findings like this on daily.dev._ ### Can a static OpenAPI linter fully check for OWASP API Security issues like object-level authorization or SSRF? No, static OpenAPI linting cannot fully verify runtime authorization or SSRF allow-listing since those depend on request-time behavior an OpenAPI document cannot express. The Spectral OWASP Ruleset instead marks these as advisory proxy checks, such as verifying that auth is declared on an operation, while flagging that full enforcement still requires code, tests, and gateway controls. _Developers deciding where static linting stops and runtime enforcement begins can follow this reasoning on daily.dev._ ## Similar posts on daily.dev - [From a Prose Style Guide to a Grounded Spectral Ruleset](https://daily.dev/posts/from-a-prose-style-guide-to-a-grounded-spectral-ruleset-snxkckaxo) · API Evangelist · 0 upvotes · 0 comments - [The Open API Governance Toolchain](https://daily.dev/posts/the-open-api-governance-toolchain-sk3zf1qjy) · API Evangelist · 0 upvotes · 0 comments - [Spectral Rules: Machine-Readable Enforcement](https://daily.dev/posts/spectral-rules-machine-readable-enforcement-jkb1uojuv) · API Evangelist · 1 upvotes · 0 comments - [Ninety-Five Companies Publish Their API Design Rules, And APIs.io Lists Them First](https://daily.dev/posts/ninety-five-companies-publish-their-api-design-rules-and-apis-io-lists-them-first-limjguvic) · API Evangelist · 0 upvotes · 0 comments - [Howto Catch Risky JavaScript Bugs with eslint-plugin-security](https://daily.dev/posts/howto-catch-risky-javascript-bugs-with-eslint-plugin-security-rkfc7qi0w) · JS Dev Space · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#openapi](https://daily.dev/tags/openapi) [View this post on daily.dev](https://daily.dev/posts/a-grounded-spectral-ruleset-for-the-owasp-api-security-top-10-uvshv2uzr) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"A Grounded Spectral Ruleset for the OWASP API Security Top 10","url":"https://daily.dev/posts/a-grounded-spectral-ruleset-for-the-owasp-api-security-top-10-uvshv2uzr","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/a-grounded-spectral-ruleset-for-the-owasp-api-security-top-10-uvshv2uzr"},"datePublished":"2026-07-14T12:45:43.656Z","dateModified":"2026-09-13T20:04:00.073Z","description":"A Spectral ruleset published to npm as `@api-common/spectral-owasp-ruleset` maps all 10 OWASP API Security Top 10 (2023) categories to 22 linting rules. It...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aa4277c29e453d7fbc33f4f4d4504b3c?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aa4277c29e453d7fbc33f4f4d4504b3c?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"API Evangelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"API Evangelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/a36244ae67bc4f41a605f780267ecb5f","url":"https://daily.dev/sources/apievangelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/a-grounded-spectral-ruleset-for-the-owasp-api-security-top-10-uvshv2uzr","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,openapi","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"API Evangelist","item":"https://daily.dev/sources/apievangelist"},{"@type":"ListItem","position":3,"name":"A Grounded Spectral Ruleset for the OWASP API Security Top 10"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/a-grounded-spectral-ruleset-for-the-owasp-api-security-top-10-uvshv2uzr#faq","mainEntity":[{"@type":"Question","name":"Is there a Spectral ruleset that checks OpenAPI specs against the OWASP API Security Top 10?","acceptedAnswer":{"@type":"Answer","text":"Yes, the Spectral OWASP Ruleset published to npm as @api-common/spectral-owasp-ruleset provides 22 checks covering all ten OWASP API Security Top 10 (2023) categories. It uses only Spectral's built-in functions like defined, truthy, pattern, and schema, requires no custom JavaScript, and lints both Swagger 2.0 and OpenAPI 3.x with format-gated rule variants. Teams tightening API security gates can track new governance tooling like this via daily.dev."}},{"@type":"Question","name":"What percentage of public API pipelines run security linting rules?","acceptedAnswer":{"@type":"Answer","text":"Only 14 percent of 1,005 public API pipelines studied run any security rules at all, and just 3.4 percent emit SARIF output for whatever security tooling they do use. This gap in automated API security governance motivated building a dedicated OWASP-mapped Spectral ruleset that teams can add with a single line in their existing OpenAPI linting setup. Anyone benchmarking their own API pipeline's security coverage can follow findings like this on daily.dev."}},{"@type":"Question","name":"Can a static OpenAPI linter fully check for OWASP API Security issues like object-level authorization or SSRF?","acceptedAnswer":{"@type":"Answer","text":"No, static OpenAPI linting cannot fully verify runtime authorization or SSRF allow-listing since those depend on request-time behavior an OpenAPI document cannot express. The Spectral OWASP Ruleset instead marks these as advisory proxy checks, such as verifying that auth is declared on an operation, while flagging that full enforcement still requires code, tests, and gateway controls. Developers deciding where static linting stops and runtime enforcement begins can follow this reasoning on daily.dev."}}]} ```