Is APIsec worth it?

What middleBrick covers

Black-box scanning with risk scores A–F and prioritized findings
Detection aligned to OWASP API Top 10, PCI-DSS 4.0, SOC 2 Type II
OpenAPI 3.0/3.1/Swagger 2.0 parsing with spec-to-runtime cross-reference
Authenticated scans with Bearer, API key, Basic auth, and cookie support
CI/CD integration via GitHub Action with build-gating on score thresholds
Continuous monitoring with scheduled rescans and diff detection

Scope and approach of the scanner

The tool is a black-box API security scanner that submits a URL and returns a risk score from A to F with prioritized findings. It operates with read-only methods (GET and HEAD) and text-only POST for LLM probes, completing most scans in under a minute. No agents, SDKs, or code access are required, and it supports any language, framework, or cloud target.

Detection coverage and compliance mapping

The scanner evaluates 12 categories aligned to the OWASP API Top 10 (2023), including Authentication bypasses, JWT misconfigurations such as alg=none or expired tokens, BOLA and IDOR via sequential ID probing, BFLA and privilege escalation attempts, and sensitive data exposure like PII, API keys, and error leakage. It maps findings to three frameworks: PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). For other regulations, it supports audit evidence collection and helps you prepare for controls described in frameworks such as HIPAA, GDPR, ISO 27001, NIST, CCPA, and similar regimes without claiming certification or compliance.

Authenticated scanning and safety constraints

Authenticated scanning is available from the Starter tier and requires domain verification through DNS TXT records or an HTTP well-known file, ensuring only the domain owner can submit credentials. Supported headers forwarded to the target are limited to Authorization, X-API-Key, Cookie, and X-Custom-*. The scanner uses read-only methods only and blocks private IPs, localhost, and cloud metadata endpoints at multiple layers. It does not perform destructive actions, active SQL or command injection, or test business logic directly.

OpenAPI analysis and integration options

The tool parses OpenAPI 3.0, 3.1, and Swagger 2.0 definitions with recursive $ref resolution and cross-references spec definitions against runtime findings to highlight undefined security schemes, sensitive fields, deprecated operations, and missing pagination. Integration options include a web dashboard for reports and score trends, a CLI via the middlebrick npm package with JSON or text output, a GitHub Action for CI/CD gates that fails builds below a score threshold, an MCP server for AI coding assistants, and a programmatic API for custom workflows.

Continuous monitoring, pricing, and limitations

Pro tier provides scheduled rescans every 6 hours, daily, weekly, or monthly, with diff detection for new and resolved findings and score drift. Alerts include rate-limited email notifications and HMAC-SHA256 signed webhooks that auto-disable after five consecutive failures. Pricing tiers range from Free with three scans per month and CLI access, to Starter at 15 APIs, Pro for 100 APIs with continuous monitoring and CI/CD integration, and Enterprise for unlimited APIs with custom rules and SLA. The scanner does not fix, patch, block, or remediate findings; it detects and provides remediation guidance. It cannot detect blind SSRF without out-of-band infrastructure, replace a human pentester for high-stakes audits, or guarantee results for business logic vulnerabilities.

Frequently Asked Questions

Who is this scanner worth it for?

It is worth it for teams that need frequent, automated API exposure checks and standardized risk scoring, especially when integrated into CI/CD pipelines. It is less valuable for organizations that require deep business logic testing or hands-on manual assessment for high-risk audits.

Does it replace a human penetration test?

No. The scanner identifies common configuration and input validation issues but does not detect business logic flaws or perform intrusive exploitation. A human pentester remains necessary for high-stakes audits.

Can authenticated scans be trusted with credentials?

Authenticated scanning is gated by domain ownership verification and uses a restricted header allowlist. Credentials are accepted only when the domain can prove ownership, and scan traffic is limited to safe, read-only methods.

How are findings mapped to compliance frameworks?

Findings map directly to PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). For other frameworks, it supports audit evidence collection and aligns with security controls described in related regulations without claiming certification.