Migrating from APIsec to Lasso Security

Moving from a prior scanner to middleBrick involves comparing coverage, authentication models, and output formats. This guide focuses on data export, rebuilding scan workflows in CI, and known gaps so you can plan a low risk transition.

Export findings from your current platform in its native format, then map fields to middleBrick equivalents. Typical mappings include severity to risk score, issue category to OWASP API Top 10 tags, and references to endpoint paths. Use the middleBrick CLI to validate normalized results before you rerun scans.

// Example: mapping a JSON finding to middleBrick output
const normalized = {
  source: "apisec",
  endpoint: "/users/{id}",
  method: "GET",
  category: "BOLA",
  severity: "high",
  description: "Unrestricted access to other users\u2019 resources",
  evidence: "Different ID returned 200 versus 404"
};

Rebuilding historical trend lines depends on consistent tagging; prefer mapping to OWASP API Top 10 categories and the three compliance frameworks supported by middleBrick.

Recreate your gates using the middleBrick CLI and GitHub Action. The CLI supports JSON output for scripting, and the action fails the build when the score drops below your chosen threshold. Authentication follows the same patterns as header allowlists: Bearer, API key, Basic auth, and cookies, with domain verification required for credentialed scans.

# Example GitHub Action step
- name: MiddleBrick scan
  uses: middlebrick/action@v1
  with:
    url: https://api.example.com/openapi.json
    threshold: C
    output: json

Compare how your previous pipeline passed scan IDs versus how middleBrick tracks scans by URL and schedule. Update webhook consumers to expect HMAC-SHA256 signed payloads if you use continuous monitoring.

middleBrick does not perform active SQL injection or command injection testing, and it does not detect business logic vulnerabilities; these require domain specific human analysis. It also does not detect blind SSRF via out-of-band infrastructure, nor does it replace a full manual pentest for high-stakes audits.

If your prior tool performed intrusive exploitation or active injection checks, plan for complementary testing outside of automated scanning. Use the risk score and prioritized findings to triage manual effort rather than expecting one-to-one feature parity.

middleBrick maps findings directly to OWASP API Top 10 (2023), PCI-DSS 4.0, and SOC 2 Type II. For other frameworks, it helps you prepare for audits by surfacing findings relevant to controls described in HIPAA, GDPR, ISO 27001, NIST, CCPA, and similar regimes without asserting certification or compliance.

Use the dashboard to generate branded compliance PDFs and leverage the MCP Server to integrate scanning guidance into AI assisted development workflows. Continuous monitoring provides diff detection across scans so you can track remediation progress and score drift over time.