awesome-api-security vs awesome-web-security
API security and web security resource directories compared
awesome-api-security and awesome-web-security are curated directories of security tools, guidance, and learning resources. The first focuses on API security across REST, GraphQL, and SOAP, while the second covers broader web application security topics and includes an AI assistant skill.
awesome-api-security: Find API Security Tools and Learning Resources
A curated collection of API security tools and community resources, focused on material that benefits API testers and defenders. It spans testing tools, vulnerable practice APIs, guidance, specifications, and training; the repository is archived and read-only.
awesome-web-security: Curated Web Security Resources
A curated collection of web security learning materials, tools, and research, spanning vulnerabilities, evasion techniques, browser exploitation, and penetration testing. It also provides a Claude Code Skill for querying the list at runtime.
| awesome-api-security | awesome-web-security | |
|---|---|---|
| Language | — | Python |
| License | GPL-3.0 | — |
| Stars | 3.9k | 14.1k |
| Forks | 656 | 1.8k |
| Last analyzed | Nov 2, 2026 | Nov 14, 2026 |
Key differences
- awesome-api-security centers on API discovery, testing, hardening, specifications, and vulnerable practice targets; awesome-web-security organizes resources around web vulnerability classes, browser security, and related technologies.
- awesome-api-security includes API-focused resources such as OpenAPI and AsyncAPI references, while awesome-web-security lists practical write-ups, guides, cheat sheets, and PoCs across topics such as XSS, SQL injection, and SSRF.
- awesome-api-security is a reference list and is marked archived; awesome-web-security is also a reference index and is not marked archived.
- awesome-web-security provides a Claude Code skill with Codex installation instructions; awesome-api-security describes a curated directory without a comparable assistant feature.
- awesome-api-security lists GPL-3.0 as its license and does not specify a language; awesome-web-security lists Python as its language and has no license value in the supplied metadata.
- awesome-api-security favors community-benefiting and open-source resources in its contribution criteria; awesome-web-security provides contribution guidelines for adding resources.
Choose awesome-api-security if you…
- need resources specifically for API assessment, including discovery, fuzzing, and auditing tools.
- want API hardening guidance, specifications, or vulnerable targets for practice.
- are exploring API security across REST, GraphQL, or SOAP.
Choose awesome-web-security if you…
- need a broader web application security index covering vulnerability classes and browser security.
- want practical web security write-ups, PoCs, or tools for authorized testing.
- use Claude Code or Codex and want to query the resource index through its skill.
Compare the numbers side by side, or add more projects
This comparison is generated with AI from the OSRepos analyses of both projects. Always check each project's repository and documentation before choosing.