Astra for SaaS

What middleBrick covers

Black-box API risk scoring with letter grades
OWASP API Top 10 (2023) aligned findings
Authenticated scans with header allowlist
Read-only methods with no destructive payloads
CI/CD integration via GitHub Action
Continuous monitoring and diff detection

API Security Posture for SaaS Applications

SaaS products expose public endpoints that are continuously probed. The scanner maps findings to OWASP API Top 10 (2023) and supports audit evidence for SOC 2 Type II and PCI-DSS 4.0 controls relevant to API surfaces. Black-box analysis covers authentication bypass, authorization flaws, data exposure, and input validation without requiring access to source code or runtime instrumentation.

Scan Methodology and Limitations

Scans are read-only using GET and HEAD methods, with text-only POST for LLM probes, completing in under a minute. The tool does not perform active SQL injection or command injection, does not fix or remediate findings, and does not detect business logic vulnerabilities or blind SSRF. These limitations align with the scope of a non-intrusive security assessment and clarify that the tool is a detection instrument rather than a comprehensive audit.

Authenticated Scanning for SaaS Environments

Authenticated scans with Bearer, API key, Basic auth, and Cookie are available in Starter tier and above. Domain verification via DNS TXT record or HTTP well-known file ensures only the domain owner can scan with credentials. Header allowlist is restricted to Authorization, X-API-Key, Cookie, and X-Custom-*, reducing noise and focusing coverage on authentication and authorization paths common in SaaS APIs.

Detection Coverage and Compliance Alignment

The scanner detects issues across 12 categories, including Authentication, BOLA/IDOR, BFLA, Property Authorization, Input Validation, Rate Limiting, Data Exposure, Encryption, SSRF, Inventory Management, Unsafe Consumption, and LLM/AI Security. Findings are mapped to OWASP API Top 10 (2023) and support controls described in SOC 2 Type II and PCI-DSS 4.0. For other frameworks, the tool surfaces findings relevant to audit evidence and helps you prepare for alignment with security controls described in HIPAA, GDPR, ISO 27001, NIST, CCPA, and similar regimes.

Product Integrations and Continuous Monitoring

The Web Dashboard centralizes scans, trending scores, and branded compliance PDFs. The CLI supports on-demand scans with JSON or text output. The GitHub Action enforces CI/CD gates by failing builds when scores drop below a set threshold. The MCP Server enables scans from AI coding assistants. Pro tier adds scheduled rescans, diff detection, email alerts, signed webhooks, and Slack/Teams notifications, enabling ongoing risk tracking for dynamic SaaS APIs.

Frequently Asked Questions

Can the scanner fix the vulnerabilities it finds?

No. The tool detects and reports with remediation guidance. It does not patch, block, or remediate.

Does scanning with credentials store or use my authentication tokens?

Credentials are used only during the authenticated scan flow to access protected endpoints. They are not stored beyond the scan session.

What standards does the scanner certify compliance against?

The scanner does not certify compliance. It maps findings to frameworks such as OWASP API Top 10 (2023), and supports audit evidence collection for SOC 2 Type II and PCI-DSS 4.0 where relevant.

Can I integrate scans into my CI/CD pipeline?

Yes. The GitHub Action can fail builds when the risk score drops below your threshold, and the CLI supports automated execution for pipeline integration.