42Crunch for SaaS

SaaS applications expose public APIs that expand the attack surface and require continuous security validation. middleBrick maps findings to OWASP API Top 10 (2023) and supports controls relevant to PCI-DSS 4.0 and SOC 2 Type II through detection of misconfigurations and data exposure risks.

Because scans are black-box, they operate without agents or code access, making the approach suitable for multi-tenant architectures and diverse tech stacks. The tool checks authentication mechanisms, sensitive data leakage, and common injection surfaces that commonly affect SaaS APIs.

Scanning is limited to read-only methods and text-based probes, which avoids impacting production workloads. Results highlight issues such as weak JWT configurations, CORS misconfigurations, and unversioned endpoints that commonly appear in SaaS deployments.

Authenticated scans (Starter tier and above) allow deeper validation of account-specific endpoints using Bearer tokens, API keys, Basic auth, or cookies. Domain verification ensures only the domain owner can initiate credentialed scans, reducing the risk of unauthorized testing.

When credentials are provided, the scanner follows a strict header allowlist, forwarding only Authorization, X-API-Key, Cookie, and X-Custom-* headers. This minimizes unnecessary exposure while still exercising authenticated flows.

OpenAPI specifications are parsed with recursive $ref resolution and cross-referenced against runtime behavior to detect undefined security schemes, deprecated operations, and missing pagination that often leads to over-exposure in SaaS APIs.

The scanner evaluates 12 security categories, including Authentication bypass, BOLA and BFLA, Property Authorization over-exposure, and Input Validation issues such as wildcard CORS and dangerous HTTP methods.

It also identifies Data Exposure patterns like emails, credit card Luhn checks, SSN context, API key formats for AWS, Stripe, GitHub, and Slack, and error or stack-trace leakage. Encryption checks verify HTTPS redirects, HSTS, and cookie flags.

For LLM-centric SaaS products, the tool runs 18 adversarial probes across Quick, Standard, and Deep tiers, targeting system prompt extraction, instruction override, jailbreak techniques, and token smuggling. Findings align with OWASP API Top 10 and can help prepare evidence for SOC 2 Type II audits.

middleBrick operates as a read-only scanner, never sending destructive payloads. Private IPs, localhost, and cloud metadata endpoints are blocked at multiple layers to prevent unintended probing.

Customer scan data is deletable on demand and purged within 30 days of cancellation. The platform does not sell data and does not use scan data for model training, which supports common SaaS data governance expectations.

The scanner does not perform active SQL injection or command injection testing, does not detect blind SSRF without out-of-band infrastructure, and does not replace a human pentester for high-stakes audits. Remediation guidance is provided, but no automatic fixes are applied.

The Web Dashboard centralizes scan management, report downloads, and score trend tracking. The CLI supports on-demand scans with JSON or text output, and the GitHub Action can gate CI/CD when scores drop below defined thresholds.

For AI-assisted development, the MCP Server enables scanning from coding assistants such as Claude and Cursor. Programmatic access through an API client supports custom integrations and continuous monitoring workflows.

Pricing starts with a Free tier at zero cost, offering 3 scans per month and CLI access. Starter at 99 dollars per month supports 15 APIs, monthly scans, dashboard access, and email alerts. Pro at 499 dollars per month scales to 100 APIs with continuous monitoring, CI/CD gates, and compliance reports, while Enterprise at 2000 dollars per month provides unlimited APIs, custom rules, SSO, and dedicated support.