Burp Suite for Enterprise organizations

What middleBrick covers

Black-box API scanning with no agents or SDKs
Under-one-minute scan time using safe methods
12 OWASP API Top 10 (2023) detection categories
OpenAPI 3.x and Swagger 2.0 parsing with $ref resolution
Authenticated scan controls and header allowlist
Tiered integrations including CLI, dashboard, and GitHub Action

Scope and approach compared to Burp Suite for Enterprise

Burp Suite for Enterprise offers a broad attack surface with manual workflows and extensive tool integrations. middleBrick is a focused API security scanner that completes a full scan in under a minute using read-only methods. Where Burp requires significant setup and ongoing tuning, middleBrick operates without agents or SDKs and supports any language or framework.

Detection coverage aligned to major standards

middleBrick maps findings to OWASP API Top 10 (2023), supports audit evidence for SOC 2 Type II, and aligns with security controls described in PCI-DSS 4.0. The scanner covers 12 categories including authentication bypass, JWT misconfigurations such as alg=none, BOLA and IDOR enumeration, privilege escalation via admin endpoints, PII and API key exposure, unsafe third-party surface, and LLM security probes across tiered scan intensities. OpenAPI 3.0, 3.1, and Swagger 2.0 specs are parsed with recursive $ref resolution, and findings are cross-referenced against the spec to surface undefined security schemes or deprecated operations.

Operational characteristics and deployment constraints

Scan duration is under one minute with only GET, HEAD, and text-only POST methods used. Private IPs, localhost, and cloud metadata endpoints are blocked at multiple layers. Authenticated scans require domain verification through DNS TXT records or an HTTP well-known file, and the header allowlist is limited to Authorization, X-API-Key, Cookie, and X-Custom-* headers. The product does not fix, patch, or block findings; it reports with remediation guidance and exposes issues relevant to compliance frameworks without claiming certification.

Product tiers and integration options

Free tier provides 3 scans per month and CLI access. Starter at 99 dollars per month supports 15 APIs, dashboard, scheduled scans, email alerts, and MCP Server. Pro at 499 dollars per month adds continuous monitoring, up to 100 APIs with incremental pricing, GitHub Action CI/CD gates, Slack or Teams alerts, and compliance reports. Enterprise at 2000 dollars per month offers unlimited APIs, custom rules, SSO, audit logs, and dedicated support. Integrations include a web dashboard, CLI, GitHub Action, MCP Server, and a programmable API client.

Data handling, privacy, and limitations

Scan data is deletable on demand and purged within 30 days of cancellation; it is never sold or used for model training. The tool does not perform active SQL injection or command injection, does not detect business logic vulnerabilities that require domain understanding, and cannot identify blind SSRF without out-of-band infrastructure. It is not a replacement for a human pentester in high-stakes audit scenarios, and it does not provide fixes or network protection.

Frequently Asked Questions

What scan methods does the tool use?

It uses read-only GET and HEAD requests plus text-only POST for LLM probes. No intrusive payloads such as active SQL injection or command injection are sent.

How are authenticated scans controlled?

Authenticated scans require domain ownership verification via DNS TXT or HTTP well-known file. Only specific headers are forwarded, and credentials are never stored longer than needed.

Does the tool provide compliance certification?

It does not certify compliance. Findings may support audit evidence for SOC 2 Type II and PCI-DSS 4.0, but the tool is not an auditor and cannot guarantee compliance.

What is the difference between Starter and Pro tiers?

Pro adds continuous monitoring, more APIs, CI/CD integration such as GitHub Actions, scheduled scans, and team notifications. Both tiers offer dashboard and reporting, but Pro supports larger deployments and ongoing monitoring.