Bright Security review
What middleBrick covers
- Black-box API scanning with under one minute runtime
- Risk scoring with prioritized findings across 12 OWASP categories
- OpenAPI 3.x and Swagger 2.0 parsing with spec-to-runtime checks
- Authenticated scanning with header allowlist and domain verification
- Continuous monitoring with diff detection and webhook alerts
- CLI, dashboard, GitHub Action, and MCP Server integrations
Overview and positioning
This tool is a self-service API security scanner that accepts a URL and returns a risk score with prioritized findings. It operates as a black-box scanner without agents, SDKs, or code access, supporting any language, framework, or cloud. Scan duration is under one minute, using read-only methods and text-only POST probes.
Detection scope and methodology
The scanner evaluates 12 categories aligned to the OWASP API Top 10 (2023), including Authentication bypass, BOLA and BFLA, Property Authorization, Input Validation, Rate Limiting, Data Exposure, Encryption, SSRF, Inventory Management, Unsafe Consumption, and LLM/AI Security. It parses OpenAPI 3.0, 3.1, and Swagger 2.0 with recursive $ref resolution and cross-references spec definitions against runtime findings.
For LLM/AI Security, it runs 18 adversarial probes across Quick, Standard, and Deep tiers, targeting system prompt extraction, instruction override, jailbreaks, data exfiltration, and token smuggling among other techniques. OpenAPIs with undefined security schemes, sensitive fields, or deprecated operations are flagged through spec-to-runtime comparison.
Authenticated scanning (Starter and above) supports Bearer, API key, Basic auth, and Cookie methods, gated by domain verification via DNS TXT or HTTP well-known file. Only a curated allowlist of headers is forwarded.
Product integrations and monitoring
The platform provides a Web Dashboard for scanning, report review, and score trend tracking, with downloadable branded compliance PDFs. The CLI via an npm package supports JSON and text output, and a GitHub Action can fail CI/CD builds based on score thresholds.
An MCP Server enables scanning from AI coding assistants, and an API client facilitates custom integrations. Continuous monitoring (Pro tier) includes scheduled rescans, diff detection for new or resolved findings, email alerts rate-limited to one per hour, and HMAC-SHA256 signed webhooks with auto-disable after repeated failures.
Compliance mapping and limitations
Findings map directly to PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). For other frameworks, the tool helps prepare audit evidence and aligns with described security controls without certifying or guaranteeing outcomes.
The scanner does not perform fixes, patches, or active exploitation such as SQL injection or command injection. It does not detect business logic flaws, blind SSRF via out-of-band channels, or replace human pentesters for high-stakes audits. Results are advisory and include remediation guidance.
Pricing and data safety
Free tier offers 3 scans per month with CLI access. Starter at 99 USD per month supports 15 APIs, dashboard, email alerts, and MCP Server. Pro at 499 USD per month covers 100 APIs with continuous monitoring, GitHub Action gates, and compliance features; Enterprise at 2000 USD per month provides unlimited APIs and SSO. Additional APIs are billed incrementally.
Scan data is read-only and deletable on demand, purged within 30 days of cancellation. Customer data is never sold or used for model training. The platform blocks destructive payloads and private IP probes and maintains layered defenses against localhost and cloud metadata endpoints.