Is 42Crunch good for Internal microservice audit?

What middleBrick covers

Black-box scanning without agents or SDK dependencies
Read-only methods with LLM probe support
OpenAPI 3.x and Swagger 2.0 contract validation
Detection of authentication and authorization misconfigurations
LLM security probes across multiple depth tiers
CI/CD integration via GitHub Action and MCP Server

Scope and approach for internal microservice audits

An internal microservice audit requires visibility into runtime behavior without access to service code or deployment pipelines. This scanner operates as a black-box solution, submitting only read-only HTTP methods and text-based LLM probes to endpoints. It does not need agents, SDKs, or build-time instrumentation, which suits environments where you cannot modify service images or sidecars.

Detection coverage aligned to known standards

The scanner evaluates 12 categories mapped to OWASP API Top 10 (2023) and surfaces findings relevant to security controls described in SOC 2 Type II and PCI-DSS 4.0. Coverage includes authentication bypass, JWT misconfigurations such as alg=none and expired tokens, authorization flaws like BOLA and BFLA, PII exposure including Luhn-validated card numbers and context-aware SSN patterns, and unsafe data transmission indicators such as missing HSTS or insecure cookie flags. For LLM-facing services, it runs 18 adversarial probes across Quick, Standard, and Deep tiers to identify system prompt extraction risks, instruction override attempts, data exfiltration paths, and token smuggling.

OpenAPI contract validation and runtime correlation

It parses OpenAPI 3.0, 3.1, and Swagger 2.0 documents with recursive $ref resolution and cross-references spec definitions against observed runtime behavior. This helps identify undefined security schemes, deprecated operations missing pagination, and sensitive fields exposed beyond intended boundaries. The approach supports audit evidence for control validation without claiming compliance or certification for any regulatory framework.

Authenticated scanning constraints and safety posture

Authenticated scans are available in Starter and higher tiers, supporting Bearer tokens, API keys, Basic auth, and cookies. Domain verification is enforced via DNS TXT records or an HTTP well-known file to ensure only domain owners can submit credentials. Header forwarding is limited to Authorization, X-API-Key, Cookie, and X-Custom-* values. The scanner follows a strict read-only policy, with destructive payloads never sent and infrastructure-level blocks for private IPs, localhost, and cloud metadata endpoints. Customer data can be deleted on demand and is purged within 30 days of cancellation.

Reporting, integrations, and monitoring tradeoffs

Results are delivered through a web dashboard with trend tracking and downloadable compliance PDFs, and the CLI provides JSON or text output via middlebrick scan <url>. A GitHub Action can gate CI/CD when scores drop below a threshold, and the MCP Server enables scanning from AI coding assistants. Continuous monitoring on Pro tiers supports scheduled rescans, diff detection for new or resolved findings, and HMAC-SHA256 signed webhooks. Note that the tool does not fix, patch, or block findings, and it does not detect business logic vulnerabilities or blind SSRF, which often require human-led threat modeling.

Frequently Asked Questions

Is this tool suitable for a full internal microservice audit?

It is a strong component for external-facing endpoint assessment and contract validation, but it does not replace manual review of business logic or environment-specific hardening required inside microservice meshes.

Can authenticated scans access internal APIs behind service meshes?

Authenticated scans work if the endpoint is reachable over the network and the ingress allows the permitted methods and headers. Service mesh mTLS or internal routing must allow the scanner IPs and presented credentials.

Does the scanner test for SQL injection or command injection?

It does not perform active SQL injection or command injection tests, as those require intrusive payloads outside the intended scope of a read-only scanner.

How are compliance mappings presented in reports?

Findings are mapped directly to OWASP API Top 10 (2023), with references to security controls described in SOC 2 Type II and PCI-DSS 4.0. Other regulations are addressed through alignment language only.