Search

Escape - Application Security & Offensive Security Blog

Explore practical offensive and application security insights covering web application testing, emerging AI cybersecurity research, API and GraphQL security, and advanced testing techniques.

Filters

Escape raises $3.9 million in seed to secure APIs at every development stage

Announcement

Escape raises $3.9 million in seed to secure APIs at every development stage

Official Press release * Six months after releasing its API security platform, Escape has already secured the applications of 1000+ organizations worldwide and just graduated from Y Combinator. * The funding will allow the company to hire new team members covering European and US-based customers, aiming to double the team’s size in the coming 12 months. If you are interested, take a look at Escape's Open Positions. Paris, Tuesday June 6th 2023 – Escape, the API security company, freshly out

Escape - Offensive Security

Escape - Offensive Security

4 min read

Unveiling the GraphQL API Catalog

Attack Surface Management

Unveiling the GraphQL API Catalog

Escape launches the first Asset Inventory and Attack Surface Management solution for GraphQL APIs with its new API Catalog feature.

Antoine Carossio

Antoine Carossio

3 min read

Introducing Seamless GraphQL Compliance

GraphQL

Introducing Seamless GraphQL Compliance

As your go-to partner in GraphQL Security, we at Escape are constantly innovating to simplify and streamline security for you. We're proud of our reputation for crafting modern, dynamic application security testing (DAST) tools tailored to GraphQL, beloved by developers and trusted by security teams worldwide. From comprehensive reporting features and vulnerability checks to seamless CI/CD integrations and remediation assistance, our platform empowers your security teams to ensure robust GraphQL

Antoine Carossio

Antoine Carossio

3 min read

GraphQL XSS: Cross-Site Scripting Explained

GraphQL Vulnerability

GraphQL XSS: Cross-Site Scripting Explained

Every Monday morning, you go through your ritual and check the users' feedback. This week, despite all the wonderful feedback, some users are complaining that someone has impersonated them and performed actions on their accounts without their knowledge. After some investigation, you discover that all the complaining users have each logged in from different IP addresses in the past week and moreover, one IP address comes up several times on different accounts. So there really could be an attacke

Achraf Ait Sidi Hammou

Achraf Ait Sidi Hammou

5 min read

GraphQL Input Validation & Sanitization

GraphQL

GraphQL Input Validation & Sanitization

Why input validation and sanitization are important in GraphQL? GraphQL allows you to identify the data and validate inputs based on type information. By default, GraphQL Specification has the Int, Float, String, Boolean and ID Scalar types. But as a conscious API developer, you've probably come across situations where user input needs to be validated and sanitized before being processed. Input validation and sanitization are essential to ensure your data's integrity, consistency, and s

Antoine Carossio

Antoine Carossio

5 min read

Say Hi to SecureGPT: The free Security Tool for ChatGPT Developers

Say Hi to SecureGPT: The free Security Tool for ChatGPT Developers

👋 tl;dr Are you a ChatGPT plugin developer who wants to ensure the safety and security of your creations? Look no further. Escape is thrilled to announce the release of SecureGPT, a lightning-fast and free security tool designed specifically for ChatGPT plugins. Secure your ChatGPT plugins in seconds with SecureGPT at https://escape.tech/securegpt/ With the ever-growing popularity of ChatGPT, it has become imperative to prioritize the security of plugins. Indeed, while the introduction of plug

Antoine Carossio

Antoine Carossio

2 min read

Top 5 GraphQL vulnerabilities burdening HIPAA compliance

GraphQL

Top 5 GraphQL vulnerabilities burdening HIPAA compliance

TL;DR: GraphQL vulnerabilities will inevitably burden organizations, especially when healthcare compliances like HIPAA come into play. This article highlights how Escape makes it super easy to release compliant APIs. The correlation between HIPAA and GraphQL is that PHI resources can be exposed through GraphQL APIs, allowing for a more efficient and flexible way of accessing and querying data. By using GraphQL, healthcare companies can improve the performance of their applications and reduce th

Escape - Offensive Security

Escape - Offensive Security

5 min read

Introducing Escape v2: More Power, More Security, and More Control Over Your GraphQL APIs

Introducing Escape v2: More Power, More Security, and More Control Over Your GraphQL APIs

tl;dr we are releasing the biggest update of our GraphQL Security platform so far. It includes numerous new features, including API Posture management, Reporting Overview, Better CI/CD Integration,  GitHub SSO, and OWASP API Top 10 2023 Support. Hello, Escape community! We are thrilled to announce the release of Escape v2, the result of months of intense work by the Escape team, driven by feedback from the community and our users. Our latest version is packed with exciting new features with a

Tristan Kalos

Tristan Kalos

3 min read

Demystifying GraphQL Security: A Comprehensive Guide to GraphQL Introspection

GraphQL Vulnerability

Demystifying GraphQL Security: A Comprehensive Guide to GraphQL Introspection

Whether or not to disable introspection in GraphQL has been a common debate among GraphQL developers since its inception. In this blog post, we will explain why completely disabling GraphQL introspection is not necessary and why it can be counterproductive. I can't really find any good reasons for blocking/removing #GraphQL introspection capabilities for security reasons. Sounds a lot like "security through obscurity". Can anyone think of something that can't be better solved by visibility fil

Antoine Carossio

Antoine Carossio

5 min read

The State of Public APIs 2023

Research

The State of Public APIs 2023

tl;dr we scanned 6056+ public APIs on the internet with our in-house feedback driven exploration tech and ranked them using security, performance, reliability, and design criteria. We decided to analyze the resulting data and produce a full featured report: The State of Public APIs 2023 Why build this report? 🤔 Two weeks ago, we released apirank.dev, the result of extensive research on public APIs on the internet, conducted at an unprecedented scale using our feedback-driven API exploration

Escape - Offensive Security

Escape - Offensive Security

2 min read

The EU’s PSD2: API Security and Financial Services

The EU’s PSD2: API Security and Financial Services

In 2015, the European Union adopted the Revised Payment Services Directive (PSD2). This legislative framework aimed to fix the financial services market, which was disrupted by the arrival of new innovative players. The 2010s gave birth to numerous FinTech startups providing new services in addition to traditional banking institutions. These services range from mobile payment solutions to online financial management, accounting, or crowdfunding platforms. Coined as Third Party Providers (TPP),

Pierre Coquelle

Pierre Coquelle

5 min read

APIRank.dev: we scanned and ranked 6031+ public APIs on the internet

Announcement

APIRank.dev: we scanned and ranked 6031+ public APIs on the internet

tl;dr we scanned 6031+ public APIs on the internet with our in-house feedback driven exploration tech and ranked them using security, performance, reliability, and design criteria. The results are public on APIrank.dev. You can also request to index your own API for free and see how it compares to others. Why APIrank? 🤔 During a YC meetup, I spoke with fellow founder Andrew Kim from Finex. He told me about their struggle to select the right API providers in his past companies. It's true tha

Tristan Kalos

Tristan Kalos

3 min read

Introducing API Security Posture Management for GraphQL

Introducing API Security Posture Management for GraphQL

tl;dr The Escape Team is excited to announce the release of its latest feature, API Security Posture Management for GraphQL. This feature proposes a single API Catalog view to explore the security, integrity, and performance of all GraphQL operations in one place. See it for yourself in action With the rise of GraphQL as a popular API technology, it is essential to have an effective security solution in place, and Posture Management is designed to meet this need. Escape's API Posture Managemen

Antoine Carossio

Antoine Carossio

2 min read

Introducing OpenAPI.Security, a free tool to quickly check the security of REST APIs

Introducing OpenAPI.Security, a free tool to quickly check the security of REST APIs

tl;dr We released OpenAPI.security, an online tool that performs a dozen of security tests on any given OpenAPI/Swagger-based API, with no signup or email required Our team at Escape is mainly focused on securing GraphQL APIs. For this, we developed a new approach called feedback-driven API exploration, basically inferring the right security test cases to run using the specification and a carefully crafted in-house graph traversal algorithm. - We published a more in-depth review of this algorit

Antoine Carossio

Antoine Carossio

1 min read

Escape is proud to be backed by Y Combinator!

Escape is proud to be backed by Y Combinator!

Escape is proud to announce that we are backed by Y Combinator, the world's most prestigious and well-known startup accelerator, joining the YC Winter 23 batch! Y Combinator, known for investing in and mentoring early-stage startups, has an impressive portfolio of successful companies such as Airbnb, Dropbox, and Stripe. A couple of months ago, we met Algolia co-founder Nicolas Dessaigne and discussed our vision that every company will soon have to release public APIs, yet developer teams lack

Antoine Carossio

Antoine Carossio

2 min read

The 8 Most Common GraphQL Vulnerabilities (and How to Fix Them)

GraphQL Vulnerability

The 8 Most Common GraphQL Vulnerabilities (and How to Fix Them)

We at Escape have been scanning GraphQL APIs for vulnerabilities for more than two years. In this post, we will share the most common GraphQL vulnerabilities, affecting close to all GraphQL APIs we have scanned. We strongly recommend you check your GraphQL APIs for these vulnerabilities.

Gautier Ben Aïm

Gautier Ben Aïm

4 min read

How to set up modern design system using Storybook and Figma

How to set up modern design system using Storybook and Figma

As our product expands, and so does our team, we need to have a better workflow. By basing themselves on a single source of truth, designers and developers speak the same language, and everyone can then focus on the essential: the user experience. This source of truth is called the design system, and we will tell you how we put it in place at Escape. But first, a little explanation of what it is exactly. What is a design system? As Dan Mall writes in his article What is a Design system?, th

Sophie Boulaaouli

Sophie Boulaaouli

5 min read

Find & Fix GraphQL API Security Issues with Postman

Postman

Find & Fix GraphQL API Security Issues with Postman

Improve the security of your GraphQL API with Escape and Postman Are you tired of dealing with pesky API vulnerabilities? Want to take your GraphQL game to the next level? Introducing the perfect combo for GraphQL success - Escape and Postman. Escape is a tool that helps developers automatically and continuously test their GraphQL API to discover vulnerabilities and suggest ways to fix them. Postman is a widely used software for designing, testing, and maintaining APIs, with solid support for

Nohé Hinniger-Foray

Nohé Hinniger-Foray

3 min read

GraphQL errors: the Good, the Bad and the Ugly

Best Practices

GraphQL errors: the Good, the Bad and the Ugly

Managing GraphQL errors can be quite a challenging task, and we tried a lot of different approaches over time. Keep reading to know what we've learned along the way.

Gautier Ben Aïm

Gautier Ben Aïm

7 min read

Rendering emails with Svelte

Rendering emails with Svelte

We recently rebuilt our whole email stack from scratch to improve the developer experience: we now have an instant feedback loop, leveraging a SvelteKit-powered dev server.

Gautier Ben Aïm

Gautier Ben Aïm

6 min read

Feedback Driven API exploration at the service of GraphQL Security

Feedback Driven API exploration at the service of GraphQL Security

Introduction Automating the audit of APIs is a very hard problem: we want to dynamically evaluate those APIs' security, performance, and reliability. But APIs take parameters that are tightly coupled to the underlying business logic. We need a way to know what sequences of requests to send, with what parameters, and in which order to have maximum API coverage to improve the scan quality. A naive automated would also not work: putting random data in parameters would likely not pass the API's

Ulysse Mavrocordatos

4 min read

Migrating from Vue 2 to Svelte

Migrating from Vue 2 to Svelte

After using Vue 2 as our front-end framework for almost two years, it was announced that this support would no longer be maintained, so we decided to migrate to a new framework. But which one to choose: Vue 3 or Svelte? Please note that our goals after the migration were also to improve our developer experience especially type checking, performance, and building time. We didn't consider React because it would have taken too much time to learn, and it doesn't offer an out-of-the-box solution, as

Gautier Ben AïmSophie Boulaaouli

Gautier Ben Aïm, Sophie Boulaaouli

7 min read

Achieving end-to-end type safety in a modern JS GraphQL stack – Part 2

Achieving end-to-end type safety in a modern JS GraphQL stack – Part 2

Welcome back! This article is the second and last part of the Achieving end-to-end type safety in a modern JS GraphQL stack series. Read the first part if you haven't yet! Svelte I won't go into the details of why Svelte, but I like Svelte a lot. It feels great writing Svelte code. And did I mention that it also offers type safety? The easiest way to set up a new Svelte website is with SvelteKit; let's go back to the packages directory and create a new SvelteKit project: # Create a Sve

Gautier Ben Aïm

Gautier Ben Aïm

5 min read