Migrating from 42Crunch to Veracode

This guide outlines how to move API security scanning workflows from 42Crunch to middleBrick. It focuses on data export, rebuilding scan history, and preserving CI wiring, without implying a feature equivalence. middleBrick is a scanner that reports findings and risk scores; it is not an auditor and cannot recreate historical test artifacts from 42Crunch.

42Crunch stores configuration and scan metadata in its platform. Extract what you can before switching, such as exported scan definitions, policy rules, and job schedules. middleBrick accepts a submitted URL and read-only methods (GET, HEAD, text-only POST) to perform black-box scans. You will lose the original 42Crunch UI layouts and raw evidence; plan to rebuild documentation from exported artifacts and from new middleBrick reports.

• Export scan policies and security rules from 42Crunch admin console.
• Record target URLs, authentication schemes, and header configurations used in 42Crunch jobs.
• Recreate equivalent scans in middleBrick using the CLI or dashboard, supplying the same endpoints and auth context.

There is no automated migration tool; treat this as a manual rebuild using the exported data as a reference.

Scan history is not transferred between systems. In middleBrick, you establish a new baseline by running scans on the same targets and with the same authentication context. Use the dashboard to track score trends over time and compare findings across new scans. For each API, record the initial risk score and key findings so that future runs provide comparable deltas. middleBrick supports scheduled rescans and diff detection to highlight new findings and resolved findings across scans.

• Run an initial full scan for each API in the same environment used by 42Crunch.
• Save the resulting score and finding list as a reference point.
• Schedule regular rescans to measure security posture change.

If 42Crunch was integrated into CI pipelines, replace those calls with middleBrick equivalents. The middleBrick CLI provides a direct substitute for scan execution, returning JSON or text output that can be parsed in scripts. The GitHub Action can gate builds based on a score threshold, and the MCP Server allows AI coding assistants to trigger scans. Ensure that CI secrets (auth tokens, headers) are reconfigured in your new workflows, respecting the header allowlist enforced by middleBrick.

middlebrick scan https://api.example.com --auth-type bearer --auth-token "$API_TOKEN"

For CI/CD gates, configure the action to fail when the score drops below your defined level. middleBrick emits signed webhooks for automated downstream systems; these differ from 42Crunch integrations and must be reimplemented.

middleBrick does not replicate 42Crunch policy templates or custom rule sets. Findings are mapped to OWASP API Top 10 (2023), PCI-DSS 4.0, and SOC 2 Type II, but historical 42Crunch compliance mappings will not transfer. You will need to re-map findings to your internal compliance documentation. The scanner performs read-only checks and does not execute intrusive payloads, so vulnerabilities requiring exploit verification will need manual follow-up.

• No automated conversion of 42Crunch policy definitions.
• No historical evidence or raw request/response storage from 42Crunch.
• Authenticated scanning requires domain verification and a restricted header set.