APIsec as a CI security gate

What middleBrick covers

Black-box API scanning with read-only methods under one minute
12 OWASP API Top 10 categories with risk scoring A–F
OpenAPI 3.0/3.1/Swagger 2.0 parsing with $ref resolution
Authenticated scans with header allowlist and domain verification
CI/CD gating via GitHub Action and score threshold rules
Continuous monitoring with HMAC-SHA256 signed webhooks

Purpose and scope of APIsec as a CI gate

APIsec functions as a scanner that you can place in CI to assess public-facing endpoints before promotion. It sends only read-only requests, such as GET and HEAD, plus text-only POST for LLM probes, and does not modify systems. The tool maps findings to three frameworks and supports audit evidence for relevant controls, while explicitly avoiding claims of certification or compliance.

Detection capabilities aligned to standards

APIsec covers the OWASP API Top 10 (2023) and maps findings to PCI-DSS 4.0 and SOC 2 Type II where applicable. Detection includes authentication bypass, JWT misconfigurations such as alg=none or expired tokens, BOLA and IDOR via sequential ID probing, BFLA through admin endpoint discovery, and input validation checks like CORS wildcard with credentials. Additional categories include sensitive data exposure (PII, credit card Luhn patterns, API keys), encryption issues, SSRF indicators, inventory problems, unsafe consumption surfaces, and LLM security probes across tiered scan depths.

OpenAPI analysis and authenticated scanning

APIsec parses OpenAPI 3.0, 3.1, and Swagger 2.0 with recursive $ref resolution and cross-references spec definitions against runtime behavior. This can highlight undefined security schemes, sensitive fields, deprecated operations, and missing pagination. Authenticated scanning supports Bearer, API key, Basic auth, and cookies, gated by domain verification using DNS TXT records or an HTTP well-known file. Only a restricted allowlist of headers is forwarded to limit credential exposure.

CI integration and workflow behavior

In CI, the CLI command middlebrick scan <url> produces JSON or text output that can gate promotions based on score thresholds. The GitHub Action fails builds when the score drops below a configured level, and diffing between scans highlights new findings or regressions. Continuous monitoring options rescan on schedules and deliver alerts, with webhook signatures verified using HMAC-SHA256 and safeguards against repeated failures.

Limitations and responsible usage

APIsec does not fix, patch, or block issues; it reports findings with remediation guidance. It does not perform active SQL injection or command injection testing, nor does it detect business logic vulnerabilities, blind SSRF, or many client-side issues. The tool should complement, not replace, human pentesters for high-stakes audits, and scan data can be deleted on demand per the data retention policy.

Frequently Asked Questions

Can APIsec replace a human pentester?

No. APIsec detects and reports issues with remediation guidance but does not validate business logic or replace the expertise required for high-stakes audits.

What happens to scan data after cancellation?

Customer scan data is deletable on demand and purged within 30 days of cancellation. It is never sold and is not used for model training.

Does APIsec test for SQL injection or command injection?

No. The scanner avoids intrusive payloads and does not perform active SQL injection or command injection testing.

How are false positives handled in CI gates?

Gates use score thresholds and diffing between scans to surface new findings or regressions. Teams can adjust thresholds and review reports to manage false positives.