Wallarm for Pre-production staging scan

What middleBrick covers

Black-box scanning with no agents or code access
Risk scoring with prioritized findings (A–F)
OpenAPI 3.0/3.1 and Swagger 2.0 parsing with ref resolution
Authenticated scans with header allowlist controls
CI/CD integration via GitHub Action and CLI
Continuous monitoring and diff detection in Pro tier

Purpose and scope of pre-production scanning

Pre-production environments serve as a final validation layer before production deployment. They host near-real configurations without live customer traffic, which makes them suitable for security testing. middleBrick is a scanner designed for this phase: you submit a URL and receive a risk score with prioritized findings. Because it is read-only, it avoids destructive tests and is appropriate for staging hosts that must remain stable.

Detection coverage aligned to standards

middleBrick maps findings to OWASP API Top 10 (2023), PCI-DSS 4.0, and SOC 2 Type II controls. Within these frameworks, it covers authentication bypass attempts, JWT misconfigurations such as alg=none and expired tokens, authorization flaws including BOLA and BFLA, and sensitive data exposure like PII and API key patterns. Input validation checks include CORS wildcard usage, dangerous HTTP methods, and debug endpoints. The scanner also detects encryption issues such as missing HSTS and mixed content, and enumerates SSRF indicators where applicable.

OpenAPI analysis and runtime correlation

The scanner parses OpenAPI 3.0, 3.1, and Swagger 2.0 documents with recursive $ref resolution. It cross-references spec definitions against runtime observations to highlight undefined security schemes, sensitive fields in responses, deprecated operations, and missing pagination. This helps identify discrepancies between declared behavior and actual endpoints, which is valuable when validating contracts in a staging context.

Authenticated scanning and safety controls

Authenticated scanning is available in Starter tier and above, supporting Bearer tokens, API keys, Basic auth, and Cookies. Domain verification is enforced via DNS TXT records or an HTTP well-known file, ensuring only the domain owner can scan with credentials. The scanner limits forwarded headers to an allowlist and follows read-only methods only. Destructive payloads are never sent, and internal endpoints such as private IPs, localhost, and cloud metadata are blocked at multiple layers.

Integration into staging workflows

middleBrick provides multiple interfaces for pre-production use. The CLI allows on-demand scans with JSON or text output via middlebrick scan <url>. A GitHub Action can gate CI/CD, failing the build when the score drops below your chosen threshold. The Web Dashboard centralizes scans, trends, and exportable compliance PDFs. For AI-assisted development, an MCP Server enables scanning from coding assistants. These options reduce integration friction while keeping the workflow explicit and controlled.

Frequently Asked Questions

Can I scan my pre-production API with authentication enabled?

Yes. Starter tier and above support authenticated scans using Bearer, API key, Basic auth, and cookies, provided domain verification is completed first.

Does the scanner test SQL injection or command injection in staging?

No. It does not perform active SQL injection or command injection, as those tests require intrusive payloads outside the scanner's scope.

Will scanning disrupt my staging environment or deploy new code?

How are findings mapped to compliance needs?

Findings map directly to OWASP API Top 10, PCI-DSS 4.0, and SOC 2 Type II. For other frameworks, the scanner surfaces findings relevant to audit evidence and helps you prepare for security reviews.