SpecShield

SpecShield is a web app (with optional CI/CD integration) that continuously compares your production API behavior against your OpenAPI/GraphQL schema and security rules. It passively learns real traffic patterns from gateway logs, then flags risky drift: undocumented endpoints, new parameters, relaxed auth requirements, unexpected content-types, and response fields that suddenly include sensitive data. It generates actionable pull requests to update specs or block behavior at the gateway/WAF, and it creates a simple “risk diff” report for security reviews. This is not a magic scanner: it won’t find every vuln, and it depends on having decent API telemetry. But for teams shipping weekly, it catches the boring, common failures that lead to data exposure—especially when microservices evolve faster than documentation and security sign-off. The product is designed for fast setup and low noise, or it will be ignored.