apiaxess is a zero-setup API inspection tool that ships with a preconfigured Chromium browser and an Android environment that already trust its proxy certificate, so you install an APK or use the built-in browser and immediately capture decrypted traffic. It captures both mobile and web clients, merges endpoints, shows live flows (example session: 2,481 flows, 128 endpoints merged, nine endpoints seen only from the app), and offers an interactive workbench to replay, resend or fuzz requests with four attack types and no throttling. Sessions can be exported to OpenAPI 3.1, Postman, HAR and a Python client with one command. The UI labels requests by host, method, status and authorization, and prevents test traffic from contaminating the recovered API surface.
Claims are measured: a reference Android app with 17 documented endpoints was used to score apiaxess, which found 17/17 statically, decrypted 17/17 live, and fused 17/17 confirmed endpoints. Endpoints are marked confirmed or inferred and first- or third-party; the tool reports when pinning cannot be bypassed instead of producing false positives. It is open source under Apache-2.0, cross-platform (Windows, Linux, macOS), invites code inspection (no telemetry), and targets integration into API security and reverse-engineering workflows.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
A U.S. immigration advocate sued the government after a border agent searched his phone without a warrant and copied data. He believes the government targeted him due to his activism and political work on immigration rights. (arstechnica.com)
Over 44,000 legal objections have been filed against Palantir's NHS data platform, demanding it be blocked from handling medical data. The campaign follows backlash over the company's involvement with the Israeli military and US immigration enforcement. (theguardian.com)
OpenAI claims that a Chinese AI model stole its intellectual property. The company alleges that it had previously appropriated IP from other sources. (theregister.com)
Android developers face new requirements to publish apps, including a $25 verification fee and identity verification, even for small-scale projects. These policies have caused frustration among developers who want to share their apps freely without extensive registration processes. (twitter.com)
Christa Pike, the only woman on Tennessee's death row, was reportedly still alive after receiving two lethal injections. Her lawyers are seeking to halt her execution, citing that she remained conscious and had a heartbeat despite the injections. (nbcnews.com)
Sandboxing alone may not be enough to contain rogue agents, as advanced attackers can find ways to bypass these security measures. Additional cryptographic and security strategies are necessary to effectively limit malicious activities. (blog.cryptographyengineering.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.