APIsec for Series B/C companies

What middleBrick covers

Fast risk scoring and prioritized findings in under a minute
Covers OWASP API Top 10, PCI-DSS 4.0, and SOC 2 Type II mapping
Black-box scanning with no agents or SDKs required
Support for OpenAPI 3.x and Swagger 2.0 with $ref resolution
Authenticated scans with strict header allowlisting and domain verification
Programmable access via CLI, API, GitHub Action, and MCP Server

Risk visibility in under a minute

For Series B and C organizations, API surface area expands quickly and risk assessment must keep pace. Submit any public URL to receive a letter-grade risk score from A to F and a prioritized list of findings within 60 seconds. The scanner uses only read-only methods such as GET and HEAD, with text-only POST reserved for LLM probes, ensuring no destructive operations are performed against your endpoints.

Detection aligned to industry standards

Each scan maps findings to three well-established frameworks: PCI-DSS 4.0, SOC 2 Type II, and OWASP API Top 10 (2023). This alignment helps you prepare for audits and supports evidence collection for security reviews. Detection covers 12 categories including authentication bypass, broken object level authorization, business logic abuse surfaces, property authorization, input validation flaws, rate limiting issues, data exposure such as PII and API keys, encryption misconfigurations, SSRF indicators, inventory management gaps, unsafe consumption patterns, and LLM/AI security probes across tiered scan depths.

OpenAPI spec validation

The scanner parses OpenAPI 3.0, 3.1, and Swagger 2.0 documents with recursive $ref resolution. It cross-references spec definitions against runtime behavior to highlight undefined security schemes, sensitive fields exposed in schemas, deprecated operations, and missing pagination. This provides an additional layer of confidence when comparing expected contract behavior against actual responses.

Authenticated scanning and safe credential handling

With Starter tier and above you can add Bearer tokens, API keys, Basic auth, and cookies to scans. Before credentials are accepted, a domain verification gate checks DNS TXT records or an HTTP well-known file to confirm domain ownership. Only a limited allowlist of headers is forwarded, including Authorization, X-API-Key, Cookie, and X-Custom-* headers, reducing unintended data exposure during authenticated tests.

Operational integrations and data governance

Integrations are designed for modern delivery workflows. The Web Dashboard centralizes scans, score trends, and compliance PDF downloads. The CLI supports one-command scans with JSON or text output, and the GitHub Action can gate CI/CD pipelines when scores drop below your defined threshold. The MCP Server enables scanning from AI coding assistants, while programmable API access supports custom tooling. Continuous monitoring options provide scheduled rescans, diff detection, email alerts, HMAC-SHA256 signed webhooks, and auto-disable after repeated failures. Scan data is deletable on demand and retained no longer than 30 days after cancellation, and it is never sold or used for model training.

Frequently Asked Questions

Does this replace a human penetration test?

No. The tool identifies common technical classes of issues and provides remediation guidance, but it does not detect business logic vulnerabilities or advanced adversary techniques that require domain context.

Can authenticated scans modify data?

Authenticated scans are read-only and do not send destructive payloads. The scanner only exercises GET and HEAD methods, with text-only POST restricted to LLM probes.

How are false positives handled?

The scanner reports observable behaviors and configuration indicators. Teams should validate findings in the context of their environment and adjust thresholds or header allowlists to reduce noise.

What happens to scan data after cancellation?

Customer scan data is deletable on demand and is purged within 30 days of cancellation. The data is not retained for secondary purposes or model training.