Planck Operator

Operator, by Planck Proof, is an autonomous API penetration testing service. It takes an API base URL, an OpenAPI or Swagger specification, and credentials for one or more user roles. Operator enumerates documented operations in scope and tests them for broken object-level and function-level authorization (BOLA and BFLA), broken authentication, injection, and mass assignment. When multiple roles or tenant identities are supplied, it can replay requests across those identities to test authorization boundaries.