Akto as a CI security gate

What middleBrick covers

  • Black-box API scanning with under one minute runtime
  • Risk score A–F with prioritized findings
  • OWASP API Top 10 (2023) coverage and mapping
  • Authenticated scans with token and cookie support
  • CI/CD integration via CLI and GitHub Action
  • Continuous monitoring and diff detection across scans

CI security gate requirements

A CI security gate must decide quickly whether a merge or deploy can proceed. It needs an automated signal, a low false-positive rate, and a clear path for developers to act on findings. The gate should integrate with existing pull request workflows and block merges only when risk exceeds an agreed threshold.

How this scanner operates in CI

This scanner is a black-box API security scanner that runs in under a minute using only read-only methods. You submit a URL, and it returns a risk score from A to F with prioritized findings. In CI, you can invoke the CLI to scan a staging environment before merging, ensuring no new critical issues are introduced.

Example CLI usage in a pipeline:

middlebrick scan https://staging.example.com --output json

The output can be parsed by scripts to gate the build based on score or specific findings.

Mapping to compliance frameworks

The scanner maps findings to PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). For PCI-DSS 4.0, it surfaces controls related to authentication and encryption. For SOC 2 Type II, it highlights evidence around access controls and monitoring. For OWASP API Top 10 (2023), it categorizes issues such as broken object level authorization and injection risks.

For other frameworks, the scanner helps you prepare for and aligns with security controls described in regulations such as HIPAA and GDPR. It supports audit evidence for internal reviews but does not certify compliance.

Authenticated scanning in CI

Authenticated scans increase coverage of protected endpoints. Provide tokens or cookies via environment variables, and the scanner validates domain ownership through DNS TXT records or HTTP well-known files. Only whitelisted headers are forwarded, limiting scope and reducing noise in CI logs.

Example header setup:

curl -H "Authorization: Bearer $TOKEN" https://staging.example.com/health

Use authenticated scans in later pipeline stages after deployment to a test environment.

Limitations and complementary testing

The scanner does not perform active SQL injection or command injection, as those require intrusive payloads outside its scope. It does not detect business logic vulnerabilities or blind SSRF, which require domain context and out-of-band infrastructure. It does not replace a human pentester for high-stakes audits. Treat it as a fast, repeatable guardrail rather than a comprehensive audit.

Frequently Asked Questions

Can this scanner block merges when risk is too high?
Yes. Use the CLI or GitHub Action to fail the build when the score drops below your chosen threshold. The action can integrate with branch protection rules.
How are false positives reduced in CI runs?
The scanner uses deterministic checks and avoids intrusive payloads. You can tune the threshold and exclude stable endpoints to reduce noise in pull request feedback.
Does scanning require code changes or SDKs?
No. It is a black-box scanner that needs no agents, SDKs, or code modifications. Provide a URL and receive a report.
Is sensitive data stored after a scan?
Customer scan data is deletable on demand and purged within 30 days of cancellation. Data is never sold or used for model training.