Alternatives to APIsec on Restify

middleBrick is a self-service API security scanner that operates as a black-box tool against Restify endpoints. Submit a URL that hosts a Restify service, and receive a risk score from A to F with prioritized findings. The scanner uses only read-only methods (GET and HEAD) plus text-only POST for LLM probes, so it does not require access to source code, agents, or SDKs. Scan times remain under one minute, and the approach is compatible with any language, framework, or cloud deployment.

For Restify services, middleBrick maps findings to OWASP API Top 10 (2023) and detects issues across 12 categories. Coverage includes authentication bypass and JWT misconfigurations, such as alg=none or HS256 usage, expired tokens, and missing claims. The scanner identifies BOLA and IDOR via sequential ID enumeration and active adjacent-ID probing, as well as BFLA and privilege escalation through admin endpoint probing and role/permission field leakage. Additional detections span property authorization over-exposure, CORS wildcard configurations, dangerous HTTP methods, debug endpoints, rate-limit header disclosure, oversized responses, and unsanitized error or stack-trace leakage.

middleBrick parses OpenAPI 3.0, 3.1, and Swagger 2.0 specifications for Restify projects, resolving recursive $ref entries and cross-referencing spec definitions against runtime behavior. This highlights undefined security schemes, sensitive fields, deprecated operations, and missing pagination. For authenticated scanning at the Starter tier and above, the scanner supports Bearer tokens, API keys, Basic auth, and cookies. Domain verification is enforced through DNS TXT records or an HTTP well-known file, ensuring only the domain owner can run scans with credentials. A strict header allowlist limits forwarded headers to Authorization, X-API-Key, Cookie, and X-Custom-*.

With Pro tier, middleBrick provides continuous monitoring for Restify APIs, including scheduled rescans every 6 hours, daily, weekly, or monthly. The system detects diffs between scans, highlighting new findings, resolved issues, and score drift, and sends email alerts rate-limited to one per hour per API. HMAC-SHA256 signed webhooks are supported, with auto-disable after five consecutive failures. The tool integrates into existing workflows via a web dashboard for report review and trend tracking, a CLI using middlebrick scan <url> with JSON or text output, a GitHub Action that fails builds when scores drop below a threshold, and an MCP server for AI coding assistants.

middleBrick does not fix, patch, block, or remediate findings; it detects and reports with remediation guidance. It does not perform active SQL injection or command injection tests, as those require intrusive payloads outside the scope. Business logic vulnerabilities are also outside automated detection, since they require domain understanding. The scanner blocks private IPs, localhost, and cloud metadata endpoints at multiple layers, and customer data is deletable on demand and purged within 30 days of cancellation. No scan data is sold or used for model training.