Migrating from 42Crunch to Snyk

Moving from a specialized API security platform to a self-service scanner involves changes in workflow, evidence handling, and tooling integration. This guide focuses on data export, rebuilding scan history, and preserving CI wiring, without asserting equivalence in audit coverage or certification capability.

Export scan reports, findings, and configuration from the source system in a structured format such as JSON or CSV. For each scan, retain the timestamp, input URL, authentication context, and the set of detected findings with unique identifiers. Map these fields to the destination tool’s schema, noting where severity labels, confidence levels, or category groupings differ. Maintain original artifacts to support audit evidence, and document any transformations applied during the migration.

Reconstruct historical trend lines by importing normalized scan records into the new platform. Because automated history reconstruction is not always possible, reconcile differences in scoring models and category definitions. Use consistent identifiers for APIs and environments, and apply time-based grouping to compare findings across scan cycles. Track score drift and new or resolved findings using the imported dataset, acknowledging that reconstructed history may not perfectly match prior platform analytics.

Update pipeline configurations to point to the new tool’s endpoints, using environment variables for URLs and tokens. Convert existing CI logic to call the new CLI or API with equivalent parameters, such as scan targets, authentication methods, and quality gate thresholds. Ensure that failure conditions are redefined based on the new tool’s score ranges and that alert routing connects to existing notification channels like email or chat systems.

middlebrick scan https://api.example.com --token $MB_TOKEN --output json

Recognize differences in detection scope, especially around intrusive testing, business logic analysis, and blind infrastructure probing. The new tool maps findings to frameworks such as OWASP API Top 10 and supports audit evidence for related controls, but it does not provide certification or compliance guarantees. Plan compensating controls or manual validation where prior platform coverage was more extensive.