Bright Security for Series B/C companies
What middleBrick covers
- Black-box API scanning with under one minute per endpoint
- Risk scoring on an A to F scale with prioritized findings
- Detection of 12 OWASP API Top 10 categories and LLM security probes
- OpenAPI 3.0/3.1/Swagger 2.0 contract validation with spec-to-runtime comparison
- Authenticated scans with header allowlists and domain verification
- CI/CD integration via GitHub Action and continuous monitoring options
API Security Posture for Scaling Engineering Teams
As your API surface expands, maintaining a clear view of risk across public and partner endpoints becomes a scaling challenge. This scanner provides a continuously updated risk score mapped to common audit frameworks, helping you compare the security posture of individual APIs and track improvements over time. Black-box scanning requires no code access or agents, so it integrates into environments using any language or framework without introducing runtime dependencies.
Scan Methodology and Limitations
The scanner performs read-only interactions using GET and HEAD methods, with text-only POST used for LLM probes. It completes in under a minute per endpoint and surfaces prioritized findings across 12 security categories aligned to OWASP API Top 10 (2023). It does not perform active SQL injection or command injection, does not detect business logic vulnerabilities, and does not replace a human pentester for high-stakes audits. Blind SSRF and runtime authentication bypass paths are out of scope because they require infrastructure that cannot be validated from outside the network.
OpenAPI Contract Validation
The tool parses OpenAPI 3.0, 3.1, and Swagger 2.0 documents with recursive $ref resolution and cross-references spec definitions against runtime behavior. This highlights undefined security schemes, sensitive fields exposed by the spec, deprecated operations, and missing pagination. Such comparisons support audit evidence for controls described in SOC 2 Type II and PCI-DSS 4.0, while also revealing inconsistencies between documented and actual API behavior.
Authenticated Scanning and Safe Data Handling
Authenticated scans support Bearer tokens, API keys, Basic auth, and cookies. Domain verification via DNS TXT record or HTTP well-known file ensures only the domain owner can submit credentials. Header forwarding is limited to Authorization, X-API-Key, Cookie, and X-Custom-* to reduce accidental data exposure. Customer scan data is deletable on demand and purged within 30 days of cancellation, and it is never sold or used for model training.
Product Integration and Continuous Monitoring
The Web Dashboard centralizes scan results, score trends, and branded compliance PDFs. The CLI allows on-demand scans with JSON or text output, and the GitHub Action can gate CI/CD when scores drop below a defined threshold. For ongoing tracking, Pro tier provides scheduled rescans, diff detection, email alerts rate-limited to one per hour per API, and HMAC-SHA256 signed webhooks that auto-disable after five consecutive failures. This setup helps you prepare for compliance reviews and supports audit evidence collection without committing engineering cycles to manual checks.