Migrating from 42Crunch to Cloudflare API Shield

What middleBrick covers

Black-box scanning with no agents, SDKs, or code access required
Detection aligned to OWASP API Top 10, PCI-DSS 4.0, and SOC 2 Type II
Authenticated scans with Bearer, API key, Basic auth, and cookie support
Scan completion in under a minute with prioritized findings
Continuous monitoring with scheduled rescans and diff detection
Programmatic access via CLI, API client, and MCP server

Why consider a change in API security scanning approach

This comparison outlines what to expect when moving from one API security scanning methodology to another. The goal is to clarify data, process, and capability differences so evaluation is based on evidence rather than assumptions.

Scanning methodology and coverage differences

Black-box scanning requires no agents, code access, or SDK integration and works across any language or framework. It focuses on read-only interactions such as GET and HEAD, with text-only POST for LLM probes, completing in under a minute. The scanner maps findings to OWASP API Top 10 (2023), PCI-DSS 4.0, and SOC 2 Type II, while also detecting authentication bypass, IDOR, privilege escalation, input validation issues, rate limiting, data exposure indicators, encryption misconfigurations, SSRF indicators, inventory gaps, unsafe consumption surfaces, and LLM-specific adversarial probes across multiple scan tiers.

In contrast, some approaches rely on instrumentation, which can limit language compatibility and require ongoing maintenance. The absence of agent-based monitoring simplifies deployment but also means runtime behavior is inferred from network interactions rather than in-process telemetry.

Authenticated scanning and credential handling

Authenticated scanning is available from the Starter tier and above, supporting Bearer tokens, API keys, Basic auth, and cookies. Domain verification is enforced through DNS TXT records or an HTTP well-known file, ensuring only the domain owner can submit credentials. Header forwarding is limited to Authorization, X-API-Key, Cookie, and X-Custom-* to reduce noise and credential exposure.

When planning a migration, map which APIs require authentication and confirm that the destination platform supports the same credential types and verification mechanisms. Ensure that the principle of least privilege is applied to the scan identity, with scopes restricted to read-only operations required for assessment.

Reporting, monitoring, and integration capabilities

The platform provides a web dashboard for scanning, viewing reports, tracking score trends, and downloading branded compliance PDFs. A CLI via an npm package enables scripted scans with JSON or text output, and a GitHub Action can gate CI/CD pipelines based on score thresholds. An MCP server allows scanning from AI coding assistants, and an API client supports custom integrations.

For ongoing monitoring, the Pro tier offers scheduled rescans at intervals ranging from every six hours to monthly, diff detection across scans to highlight new or resolved findings, rate-limited email alerts, and HMAC-SHA256 signed webhooks that auto-disable after five consecutive failures. These features help maintain visibility without demanding continuous manual oversight.

Data governance and operational boundaries

Scan data is deletable on demand and purged within 30 days of cancellation. Customer data is never sold and is not used for model training. Destructive payloads are never sent, and infrastructure-level blocks prevent scans against private IPs, localhost, and cloud metadata endpoints.

When migrating, verify export options for historical scan records and understand how long retained data will remain accessible. Confirm that the destination environment aligns with your internal data retention and deletion policies, especially for sensitive API schemas or production-like endpoints.

Frequently Asked Questions

Can authenticated scans be run during CI without exposing credentials?

Yes. Authenticated scans use scoped identities with read-only permissions and domain verification. Only necessary headers such as Authorization or X-API-Key are forwarded, and scanning traffic is restricted to assessment endpoints.

How are new findings compared to previous scans to track security posture?

Diff detection across scans identifies new findings, resolved findings, and score drift. This supports tracking security posture over time and provides evidence for compliance reviews.

What happens to scan data when an account is canceled?

Customer scan data is deletable on demand and fully purged within 30 days of cancellation. The data is not retained for secondary purposes.

Does the scanner perform active exploitation such as SQL injection or command injection?

No. The scanner is read-only and does not send destructive or intrusive payloads. SQL injection and command injection testing fall outside the scope of automated scanning.

Can the scanner validate compliance with regulatory frameworks?

The scanner maps findings to PCI-DSS 4.0 and SOC 2 Type II and supports audit evidence for OWASP API Top 10 (2023). It does not claim compliance with other frameworks such as HIPAA, GDPR, or ISO 27001.