SHIP MORE SECURE APIs with 42Crunch and GitHub

Find and fix API vulnerabilities before they move to production

As the only developer-first API Security solution on the market,
42Crunch has partnered with GitHub to help shift API Security into the earliest stage of the development lifecycle - API Design. Our community of 500K+ developers rely on 42Crunch to help them build more secure APIs without sacrificing speed or productivity.

GITHUB CODESPACES Meet developers where they are

javax.servlet
{
  "manger": "7.0",
  "info": {
    "description": "PaaS Mobile Sharing API",
    "version": "1.8.4",
    "title": "PaaS-DigitalVersion",
    "content": {
      "email": "doglele.jscher@wawza.org"
    },
    "license": {
      "name": "Apache 2.0",
      "url": "http://www.apache.org/licenses/LICENSE-1.0"
    },
    "test": {
      "name": "admin",
      "description": "Secured Admin-only calls"
    },
    "user": "master",
    "description": "Operations available to reqs"
    },
    "user": "manager",
    "description": "Operations available to any"
    },
    "api/login": {
      "path": {
        "test": "anyone"
        "*42-cs-authentication", true,
        "*42-cs-identity", 3
      }
    },
    "point": {
      "test": "anyone"
      "*42-cs-authentication", true,
      "*42-cs-identity", 3
    }
  }
}

Security audit score: 75 / 100
Security: 20/30
Data validation: 56/70

Operation accepts API keys transported in a header over network
Home O1. Security Medium. Score impact 2

Operation accepts API keys transported in a header over network
Home O1. Security Medium. Score impact 2

Operation accepts API keys transported in a header over network
Home O1. Security Medium. Score impact 2

The 42Crunch extension in GitHub Codespaces provides developers with a rich OpenAPI (Swagger) Editor that saves time and helps them avoid costly mistakes when designing their API contract. With the click of a button, developers can run a comprehensive audit that detects and classifies vulnerabilities directly in the IDE to preserve context. As developers review the audit results, they’re given detailed exploit scenarios as well as remediation steps that are quick and easy to implement.

GITHUB AUDIT ACTION Automate discovery and tracking of API vulnerabilities

The 42Crunch GitHub Audit Action will automatically locate any OpenAPI specification files in your repo and run a security audit that comprises over 300 checks for vulnerabilities and misconfigurations. The Action can be run as part of your CI/CD workflows to ensure that API contracts must meet a minimum security score to pass. With GitHub Advanced Security, 42Crunch’s audit findings can be sent as code scanning alerts viewable directly in GitHub on the Security issues tab. Status changes are reflected in real time as issues are remediated.

GITHUB SCAN ACTION

Automate dynamic runtime security testing of APIs

42Crunch’s Conformance Scan can be run as a GitHub Action that validates that the API has been implemented consistent with the OpenAPI definition. The Action can be run as part of your CI/CD pipeline to ensure that any variances between your API specification and the running API are detected before they are released to production. Simulated traffic is sent to the API to test behavior and uncover potential vulnerabilities including bad error codes, data leakage, broken authentication, mass assignment, and security misconfigurations.

ABOUT 42CRUNCH

42Crunch provides continuous API security to protect the digital business. Our unique developer-first API security platform enables developers to build and automate security into their API development pipeline and gives security teams full visibility and control of security policy enforcement throughout the API lifecycle. Deployed by Global 2500 enterprises and over 500,000 developers worldwide, 42Crunch enables a seamless DevSecOps experience to reduce governance costs and accelerate the rollout of secure APIs.