Akto as a IDE security plugin

An IDE security plugin operates inside the development environment, analyzing code as it is written and flagging issues before artifacts are committed. middleBrick is a black-box API security scanner that evaluates running endpoints without access to source code or build artifacts. The two approaches address different risk windows: IDE tooling focuses on preventing insecure patterns early, while middleBrick surfaces runtime behavior, misconfigurations, and exposure across deployed APIs.

An IDE plugin can validate code-level practices such as input sanitization, dependency hygiene, and secret handling in configuration files. It typically lacks visibility into authentication flows, rate-limiting behavior, CORS policy enforcement, or error handling in live endpoints. middleBrick maps findings to OWASP API Top 10 (2023), covering authentication bypass, BOLA / IDOR, BFLA / privilege escalation, and data exposure that manifest only during runtime. For compliance alignment, the scanner maps findings to PCI-DSS 4.0 and SOC 2 Type II, and supports audit evidence for relevant controls under frameworks described in alignment, not certification.

Unlike IDE plugins that inspect static code, middleBrick detects issues that require an active API surface. Detection categories include authentication misconfigurations such as JWT alg=none and HS256 usage, sensitive data leakage including PII and API keys, SSRF indicators involving internal IP probing, and LLM-specific adversarial probes spanning system prompt extraction and jailbreak techniques. The scanner validates input validation mechanisms, rate-limiting headers, HTTPS redirect integrity, and unsafe consumption surfaces like open webhooks and third-party callbacks, providing prioritized remediation guidance aligned with the API runtime behavior.

middleBrick parses OpenAPI 3.0, 3.1, and Swagger 2.0 documents with recursive $ref resolution, cross-referencing spec definitions against observed runtime findings. This highlights undefined security schemes, deprecated operations, and missing pagination that IDE plugins cannot infer without a live contract. Authenticated scanning supports Bearer, API key, Basic auth, and cookies, gated by domain verification using DNS TXT records or HTTP well-known files. Only a restricted allowlist of headers is forwarded, ensuring that credential scope remains controlled and auditable.

Scan execution completes in under a minute, using read-only methods and blocking destructive payloads, private IPs, localhost, and cloud metadata endpoints. Customer data is deletable on demand and purged within 30 days of cancellation, with no use for model training and no resale. The tool does not remediate, patch, or block; it reports findings with guidance. Continuous monitoring options on higher tiers provide scheduled rescans, diff detection, email alerts rate-limited to one per hour per API, and HMAC-SHA256 signed webhooks that auto-disable after repeated failures.