Wallarm for CI/CD security gate

A CI/CD security gate should validate API-facing changes before merge and deployment. middleBrick functions as a scanner that submits a URL and returns a risk score with prioritized findings. It operates as a black-box assessment using read-only methods, which limits the class of issues it can detect while reducing scan impact on production environments.

middleBrick maps findings to OWASP API Top 10 (2023), supports audit evidence for SOC 2 Type II, and aligns with controls defined in PCI-DSS 4.0. Detection coverage includes authentication bypass, JWT misconfigurations such as alg=none or expired tokens, BOLA and IDOR via sequential ID probing, BFLA and privilege escalation through role/permission leakage, input validation issues like CORS wildcard usage and dangerous HTTP methods, rate-limiting characteristics, data exposure patterns including PII and API key formats, encryption misconfigurations, SSRF indicators, and inventory issues such as missing versioning. For LLM-facing APIs, the scanner runs 18 adversarial probes across Quick, Standard, and Deep tiers to surface system prompt extraction, instruction override, jailbreak attempts, data exfiltration risks, and token smuggling.

Scan duration is under a minute per API, with no agents, SDKs, or code access required. The scanner uses read-only methods plus text-only POST for LLM probes and blocks private IPs, localhost, and cloud metadata endpoints. Because it does not execute intrusive payloads, it does not perform active SQL injection or command injection testing, nor does it detect blind SSRF or business logic vulnerabilities that require domain understanding. It also does not replace a human pentester for high-stakes audits. These limitations are explicit trade-offs that reduce noise and integration friction but narrow the set of resolvable issues.

The GitHub Action can gate merges or block promotion when the score drops below a defined threshold, providing an automated checkpoint without manual steps. CLI access enables scripting in any pipeline, and the MCP Server allows scanning from AI coding assistants. Authenticated scanning requires domain verification via DNS TXT or HTTP well-known file, and only a restricted allowlist of headers is forwarded. Continuous monitoring in higher tiers supports scheduled rescans and diff detection across runs, with email alerts rate-limited to one per hour per API and signed webhooks that auto-disable after repeated failures.

middleBrick prioritizes low integration friction and repeatable scoring rather than remediation. Customer data is deletable on demand and purged within 30 days of cancellation, with explicit guarantees that data is never sold or used for model training. Pricing tiers range from free for basic CLI use to enterprise with unlimited APIs, custom rules, SSO, and audit logs. If your workflow depends on automated patching or blocking of findings, this tool is not a fit; it surfaces findings and remediation guidance for downstream action by your team.