About EndpointCheck

EndpointCheck is a one-person project building automated API security scanning for teams that ship REST APIs.

Who builds this

Paolo Rechia is the founder and the only developer on EndpointCheck. He builds security tooling and writes about API vulnerabilities.

[Author note: replace this paragraph with two or three sentences about your background — what you work on, the kinds of problems you find interesting, and why API security specifically. Specifics beat adjectives; a reader should be able to tell who you are.]

Why this exists

Most API security tooling asks you to point it at a running API and give you a report. That is useful, but it only tells you about the endpoints somebody remembered to include, on the day you remembered to run it.

The failure mode this project targets is narrower: an endpoint that ships without enforcing the authorization rule it claims to enforce, and nobody notices until a customer reports it. That class of bug — broken object level authorization, missing ownership checks, endpoints that skip authentication entirely — is mechanical to test and easy to miss by hand. A machine can check it on every deploy.

What is on this site right now

The scanning product does not exist yet. This site currently contains three things:

• Free tools — small, focused analysers that run entirely in your browser. They are live now and will stay free.
• Written guides — explanations of API vulnerabilities and framework-specific security checklists, each technically reviewed before publishing.
• A waitlist — so that people who want the scanner can hear about it when it launches.

How this site is run as an experiment

endpointcheck.dev is deliberately a disposable domain. It exists to answer a narrow question: for an audience of API developers, does a site built from free tools and well-written security guides earn enough trust to produce signups for a product that doesn't exist yet?

That means the site is run on a small budget, with privacy-friendly analytics, and with clear separation from any other domain or project. It also means the roadmap is gated on evidence: each batch of content publishes only if the previous batch earned indexing, impressions, and waitlist signups.

If the answer turns out to be no, the honest outcome is that the site stops. That is a fine result — it is cheaper than finding out later.