security.apis.io — API Security Posture

security.apis.io indexes the security posture of API providers across the APIs.io network. It brings four security-facing artifacts into one browsable, filterable index:

• Authentication — every security scheme a provider declares in its OpenAPI definitions (API key, HTTP basic/bearer, OAuth 2.0 flows, OpenID Connect, mutual TLS).
• Domain security — live-probed transport and DNS hardening per host/domain (HTTPS, TLS version, HSTS, DNSSEC, CAA, SPF, DMARC).
• Vulnerability disclosure — published disclosure policies, security.txt, and bug-bounty programs (HackerOne / Bugcrowd / Intigriti).
• Trust center — public trust centers and the compliance certifications they name (SOC 2, ISO 27001/27017/27018, PCI DSS, HIPAA, FedRAMP, GDPR, CSA STAR, FIPS 140).

Live site: https://apis.io/security/

What's in this repo

• _security/ — one Markdown file per artifact, organized by provider slug, each carrying a kind (authentication | domain-security | vulnerability-disclosure | trust-center) and the derived detail fields. This directory is wiped and regenerated on every network build — do not hand-edit.
• index.html — the browse page, with a kind filter (Authentication / Domain Security / Vuln Disclosure / Trust Center) and a provider text filter.
• _layouts/security.html — the detail page, which branches on kind.
• _config.yml — Jekyll site configuration.

How it's built

Regenerated by network/scripts/build.py on every network rebuild. For each upstream api-evangelist provider repo it reads:

• authentication/<slug>-authentication.yml → Authentication records
• security/<slug>-domain-security.yml → DomainSecurity records
• security/<slug>-vulnerability-disclosure.yml → VulnerabilityDisclosure records
• security/<slug>-trust-center.yml → TrustCenter records

Those upstream artifacts are produced by the enrichment pipeline (all/0-working/derive-authentication.py, probe-domain-security.py, probe-security-programs.py). Add a provider's security artifacts there and they flow here on the next build. The site itself is a Jekyll build deployed via GitHub Pages behind the apis.io apex.

The APIs.io network

Part of the APIs.io network of discovery sites. See mcp.apis.io, rules.apis.io, finops.apis.io, and the full index at apis.io.