42Crunch for Sails.js
What middleBrick covers
- Black-box scanning with no agents or SDK integration
- Risk scoring from A to F with prioritized findings
- Detection of OWASP API Top 10 (2023) categories
- OpenAPI 3.x and Swagger 2.0 parsing with ref resolution
- LLM adversarial testing across multiple scan tiers
- Continuous monitoring and diff detection
Overview of API Security for Sails.js Applications
Sails.js encourages rapid development with an MVC structure and blueprint APIs that can expose dynamic endpoints. Without tight input validation and explicit route bindings, these features increase the attack surface. The middleBrick scanner assesses the runtime behavior of your API, independent of language or framework, to identify risks associated with Sails.js conventions.
Authentication and Security Header Checks
middleBrick evaluates authentication mechanisms and security headers using read-only methods. The scanner checks for JWT misconfigurations such as alg=none, weak HS256 keys, expired tokens, missing claims, and sensitive data inside claims. It also inspects the presence and correctness of WWW-Authenticate headers and security headers relevant to session management.
For Sails.js, this helps validate that your auth middleware and session settings align with secure defaults. The scanner sends only GET and HEAD requests, with text-only POST for LLM probes, ensuring no modification to authentication state.
Authorization, Input Validation, and Error Handling
The tool tests for Broken Level of Access (BOLA) and Insecure Direct Object References (IDOR) by probing sequential identifiers and adjacent resources. It also checks for Business Logic Level Authorization (BFLA) issues, such as unauthorized access to admin endpoints, and over-exposed properties that enable mass assignment.
Input validation checks include dangerous HTTP methods, CMisconfigured CORS policies (with and without credentials), and debug endpoints. Error and stack trace disclosures are flagged, as they can reveal paths, models, and internal structures in Sails.js applications.
Infrastructure Safety, SSRF, and Open Source Considerations
Infrastructure protections are evaluated through blocklists for private IPs, localhost, and cloud metadata endpoints at multiple layers. The scanner verifies HTTPS usage, HSTS headers, and secure cookie flags to ensure encryption best practices are followed.
Server-Side Request Forgery (SSRF) probes target URL-accepting parameters and body fields, looking for internal IP bypass attempts. The scanner also reviews inventory signals such as missing versioning and legacy path patterns that can aid external reconnaissance.
LLM/AI Security and OpenAPI Analysis
For applications integrating LLM features, middleBrick runs 18 adversarial probes across Quick, Standard, and Deep scan tiers. These include system prompt extraction, instruction override, DAN and roleplay jailbreaks, data exfiltration techniques, token smuggling, and nested instruction injection.
The scanner parses OpenAPI 3.0, 3.1, and Swagger 2.0 definitions with recursive $ref resolution. It cross-references the spec against runtime findings to highlight undefined security schemes, deprecated operations, and missing pagination, which are common in Sails.js integrations.